<p align="center" <picture <source media="(prefers-color-scheme: dark)" srcset="docs/assets/logo-dark.svg" / <img src="docs/assets/logo.svg" alt="Attestward" height="96" / </picture </p
Attestward
Everyone else helps you fill in the CISA attestation form. This tool proves what you're signing.
CLI binary: attestward. Product name: Attestward. Status: 1.0 — see CHANGELOG.md for what shipped. From here the CLI surface and the evidence-pack schema follow SemVer: breaking changes to either mean a major version, so a pinned v1 is safe to build against. License: Apache-2.0
---
What this is
An open-source CLI tool that connects to a software producer's source-control and CI/CD platform (GitHub or Azure DevOps) and verifies — rather than asks about — the technical controls behind a secure-software-development attestation. It maps findings to NIST SSDF (SP 800-218) practices and the CISA Secure Software Development Attestation (SSDA) Common Form's four practice clusters, and emits a signed, timestamped evidence pack (JSON + human-readable report) plus a gap analysis and a draft POA&M for anything that fails.
The problem
- In September 2022, OMB M-22-18
directed federal agencies to collect a secure-software-development attestation from software producers before using their software; CISA published a Common Form for it in March 2024, and agencies began collecting attestations against it from then. In January 2026, OMB M-26-05 rescinded the government-wide mandate to use that Common Form — agencies now set their own risk-based approach to software security, and may still require the Common Form, an equivalent of their own, or nothing at all, at their own discretion.
- That policy change doesn't reduce the stakes of actually signing one. Whenever a
producer attests to something the government relies on — the CISA Common Form, an agency-specific equivalent, or any other representation made in connection with a federal contract or a claim for payment — an inaccurate attestation is False Claims Act exposure, personally, for whoever signs it. DOJ's Civil Cyber-Fraud Initiative (launched 2021) hasn't slowed down because the mandate did: DOJ's own January 2026 report puts total FY2025 False Claims Act recoveries at a record $6.8B — its highest ever — and independent analyses of DOJ's own published settlement data (not the DOJ report itself, which doesn't break out a cyber-specific figure) put cybersecurity-related FCA recoveries at roughly $52M across nine settlements for FY2025, more than tripling in each of the past two years (Mayer Brown, March 2026).
- Today's options for the long tail of small federal software vendors: sign-and-hope, or
pay a consulting firm for a manual assessment. Nothing self-serve verifies the actual pipeline before you sign anything — whether what you're signing is the CISA form specifically or whatever your own agency now asks for instead.
- Existing "compliance automation" products primarily ask questions and store documents.
This tool's differentiator is harvested proof: it reads the real configuration and run history and shows what is actually true.
Product principles
- Verify, don't ask. If a control can be checked via API, check it. Questionnaire items