NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software
NIST's minimum standard for how software producers verify their own code under Executive Order 14028: eleven techniques from threat modelling and static analysis through coverage-measured tests, fuzzing and included-component checks, plus secure defaults and supply chain integrity at release.
NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software is a compliance framework from United States with 2 domains and 13 controls. The largest domains are Section 2: Recommended minimum standard for developer testing – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software (11 controls), Section 4: Beyond software verification – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (2)
Section 2: Recommended minimum standard for developer testing – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software
| Code | Title |
|---|---|
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.1 | Threat model early and use it to focus verification |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.10 | Run a web application scanner where the software is a web application |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.11 | Verify included software components and monitor them for known vulnerabilities |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.2 | Automate verification |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.3 | Run static (code-based) analysis |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.4 | Review the code for hardcoded secrets |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.5 | Run with language-provided checks and protection |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.6 | Create black box test cases |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.7 | Create code-based (structural) test cases and reach 80 percent statement coverage |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.8 | Keep and rerun historical test cases |
| nist-ir-8397-minimum-standards-developer-verification-of-software::2.9 | Fuzz the software |
Section 4: Beyond software verification – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software
| Code | Title |
|---|---|
| nist-ir-8397-minimum-standards-developer-verification-of-software::4.1 | Place verification inside good software development practice |
| nist-ir-8397-minimum-standards-developer-verification-of-software::4.2 | Ship secure defaults, verify all valid settings and keep supply chain integrity |
What is NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software and who does it apply to?
NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software is a compliance framework from United States with 2 domains and 13 controls. NIST's minimum standard for how software producers verify their own code under Executive Order 14028: eleven techniques from threat modelling and static analysis through coverage-measured tests, fuzzing and included-component checks, plus secure defaults and supply chain integrity at release. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software actually require?
NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software has 13 controls organised across 2 domains. The largest domains are Section 2: Recommended minimum standard for developer testing – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software (11 controls), Section 4: Beyond software verification – NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software do I already cover?
NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software?
Start your NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 13 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required