Vendors said it is unclear what qualifies as a valid attestation, what evidence must be included or how often attestations are required.