Compliance / NIST SSDF
Secure software development you can attest to.
The Secure Software Development Framework, published as NIST SP 800-218, describes practices that reduce vulnerabilities in software and limit the damage when they slip through. Federal agencies require software producers to attest that they follow key SSDF practices before the agency uses their software.
We help engineering teams assess their development lifecycle against the SSDF, close gaps in a way that fits how they ship code and prepare the evidence behind a CISA Secure Software Development Attestation.
At a glance
- Current version
- SSDF version 1.1, NIST SP 800-218 (February 2022)
- Practice groups
- Prepare the Organization, Protect the Software, Produce Well-Secured Software, Respond to Vulnerabilities
- Federal use
- Basis of the CISA Secure Software Development Attestation Form
- AI
- NIST SP 800-218A adds practices for AI model development
NIST SSDF
Four groups of practices
The SSDF organizes its practices into four groups: preparing the organization, protecting the software and its build environment, producing well-secured software and responding to vulnerabilities. It describes outcomes rather than specific tools, so it fits any language, stack or delivery model.
The attestation is signed by a company official, so it carries real accountability. We make sure the practices are in place and the evidence exists before anyone signs.
How we help
SSDF assessment
Measure your lifecycle against the practices.
- Practice-by-practice assessment
- Evidence review across teams and repositories
- Prioritized improvement roadmap
Build and pipeline integrity
Protect the software and the systems that build it.
- Source control and branch protection
- CI/CD pipeline hardening
- Artifact signing and provenance
- Software bill of materials (SBOM)
Secure development and testing
Find flaws before release.
- Threat modeling
- Secure coding standards and training
- Code review and automated testing
- Dependency and third-party component management
Vulnerability response and attestation
Handle reports well and sign with confidence.
- Vulnerability disclosure program
- Triage, remediation and customer notification
- Root cause analysis
- Attestation readiness review
Services that support this work
- Cloud, Application & Infrastructure SecuritySecure architecture and hands-on engineering for cloud platforms, applications, networks and endpoints.
- Penetration Testing & Offensive SecurityPenetration testing, red teaming and adversary simulation that show what an attacker could actually reach.
- Cyber Strategy, Risk & ComplianceRisk assessments, virtual CISO leadership and compliance readiness that hold up under scrutiny.
FAQ
Frequently asked questions
Who signs the CISA attestation?
The software producer's chief executive officer or a designee who can bind the company. That is why the evidence behind it matters.
Does the SSDF require specific tools?
No. It describes practices and outcomes. You can meet it with the tools you already use, as long as the practices are applied consistently and you can show evidence.
Find out where you stand on NIST SSDF.
A readiness review shows what an assessor would find today and what it will take to close the gaps.