Attachment 3 - RSAA Job Aid.docx

DEPARTMENT OF STATE JOB AID FOR THE

CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY’S (CISA)

REPOSITORY FOR SOFTWARE ATTESTATIONS AND ARTIFACTS (RSAA)

On March 8, 2024, CISA and the Office of Management and Budget (OMB) released the Secure Software Development Attestation Form. This form requires software producers selling software to the federal government to attest that their coding standards meet minimum secure software development requirements.

This form replaced the C-SCRM Critical Software Producer Attestation Form at the State Department. All software suppliers must submit a completed Secure Software Development Attestation Form to sell software, software licenses, or software keys to the Department.

This document outlines the procedures and frequently asked questions (FAQs) concerning the use of the RSAA. Follow the procedure outlined below to add a Secure Software Development Attestation Form to the RSAA.

Procedure ☐ Locate the RSAA web page – Navigate to CISA’s Repository for Software Attestations and Artifacts. Read the privacy notice and click “I understand.”

☐ Request and set up an account – Click “Request an Account.” Input your email address and select “Continue.” Select the account type that you are requesting (i.e., Federal User). Input the required fields: first name, last name, account type, and justification, then click “Submit for Review.” You will receive an email with a link to activate your account. Click “Set up” to set your password. Then, select and set up the multifactor authentication method of your choice.

☐ Log in to your account – Once you have completed the previous step, close that tab and navigate to the Repository for Software Attestations and Artifacts. Click “I understand,” then select “Log in to RSAA” and enter your credentials.

If clicking “Log in to RSAA” sends you back to the privacy notice page, try closing your browser, then reopening it, and accessing the website again.

Please note: It may take some time to provision your account, so if you are not directed to the RSAA page upon login, you may need to try logging in again later. If the issue continues, please contact support at TOC@mail.cisa.dhs.gov.

☐ Create a Software Record – Under the “Software Records” tab, click “New Record” on the right-hand side of the screen. Fill in the field entitled: Name of the Product or Product Line. You have the option to fill in the following fields if they’re applicable: Version Number Range, Software Producer, and Release/Publish Date. Click “Save Record.”

☐ Locate a Software Record – On the “Software Records” page, users can search, filter, and sort to find a software record. To use the search bar, type the software producer, software name, or contact in the input field and press “enter” or click the search icon on the right-hand side of the search bar.

To filter search results, select an option in the “Filter by Agency” or “Filter by Status” dropdown menus.

To sort results, choose either “Sort by Software Name” or “Sort by Software Producer” from the dropdown menu on the right.

☐ Associate a Software Record with an Agency – To associate a software record with a specific federal agency, navigate to the “Software Records” tab, locate the record, and click the ellipsis/three dots on the right-hand side of the record. Select “Associate with my Agency” from the dropdown menu.

☐ Explore other options – The dropdown menu that appears when you click the ellipsis next to a software record also provides the below options:

· Attach to Attestation(s) - Attach a software record to an existing attestation.

· Disassociate with my Agency – Disassociate the software record from an assigned agency.

· Edit Software Record – Make updates to a software record.

· Mark as Associated – Associate a software record to an agency.

· Mark as In-Review – Indicate to other RSAA users that a software record is in review.

· Flag – Indicate that a software record needs review.

· Approve – Approve a software record in-review.

· Reject – Reject a software record in-review.

☐ Upload Attestation(s) – After adding a software record, navigate to the “Attestations” tab in the site header. Click “New Attestation.”

1. Company/Label/Description: Select the name of the software producer from the dropdown “Company” menu. Next, add a short description of Attestation (i.e., “Company-wide Attestation”) in the “Label” field and click “Next.”

2. Software Records: Select the corresponding software record, indicate if the record is an “Individual Software Record(s)” or “Company Wide,” and click “Next.”

3. Artifacts (Optional): Any supplemental forms can be added as artifacts (i.e., FedRAMP 3PAO Assessments, etc.) by selecting a previously added artifact or adding a new artifact. To upload a new artifact to the attestation, select the “Upload Artifact” button on the right-hand side. Select the artifact type, add a short description of the Artifact in the “label” field, and add any comments. Select “Click to Upload” to attach the artifact. Click “OK.”

4. File/Digital Signature: Click “Select Attestation File” to upload the attestation and click “Done.”

☐ Locate an Attestation – On the main “Attestations” page, users can search attestations by label, description, or filename. The dropdown menus below the search bar enable users to filter the attestations by agency or software producer and sort the attestations by attestation label or software producer.

FAQ

Q: What should I do if I need help creating my account?

A: Contact support at TOC@mail.cisa.dhs.gov.

Q: What if I only need to upload an artifact?

A: If you need to upload an artifact, click the “Artifacts” tab and select the “New Artifact” button, located on the right-hand side of the screen. Next, select the company, artifact type, and add a label and comments if desired. Select at least one software record or attestation to attach to the artifact. Upload the artifact by selecting “Click to Upload.” Lastly, click “Upload.”

Q: Can I edit a software record, attestation, or artifact after creation?

A: Yes. Instructions are provided below.

Edit a software record: Click on the “Software Records” tab. Search for and select the software record you wish to edit. Click on the ellipses/three dots on the right-hand side of the record and select “Edit Software Record” from the dropdown menu. Users can edit the following fields: Name of the Product/Product Line, Version Number Range, and Release/Publish Date. Click “Save Record” to save updates.

Edit an attestation: Click on the “Attestations” tab to edit an attestation. Next, search for and click on the Attestation you wish to edit. Click “Next” until you reach step 4, File/Digital Signature. Click “Select Attestation File” to upload the new Attestation and click “Done.”

Edit an artifact: Click on the “Artifacts” tab to edit an Artifact. Next search and click on the Artifact you would like to edit. Keep clicking “Next” until you reach the 3rd step, Artifacts (Optional). Click “Upload Artifact” to upload the new Artifact and click “Done.”

Q: Can I delete an attestation or artifact after creation?

A: No, you cannot delete attestations and artifacts once they have been added to the RSAA. Once uploaded, these files will always be associated with the software producer.