NIST SP 800-218A
NIST's SSDF Community Profile for AI model development: the secure software development tasks that matter most for generative AI and dual-use foundation models, with AI-specific recommendations on environments, protection of weights and training data, provenance, data analysis for poisoning, adversarial testing, model scanning, input and output monitoring, and stopping or rolling back a compromised model.
NIST SP 800-218A is a compliance framework from United States with 4 domains and 37 controls. The largest domains are Produce Well-Secured Software (PW) – NIST SP 800-218A (13 controls), Prepare the Organization (PO) – NIST SP 800-218A (12 controls), Protect Software (PS) – NIST SP 800-218A (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Prepare the Organization (PO) – NIST SP 800-218A
| Code | Title |
|---|---|
| nist-sp-800-218a::PO.1.1 | Security requirements for development infrastructure and processes include AI model development (High) |
| nist-sp-800-218a::PO.1.2 | Policies carry the AI-specific security requirements for the software the organisation builds (High) |
| nist-sp-800-218a::PO.1.3 | Communicate AI model development security requirements to third-party component providers (Medium) |
| nist-sp-800-218a::PO.2.1 | Roles and responsibilities across the SDLC cover AI model development security (High) |
| nist-sp-800-218a::PO.2.2 | Role-based training covers AI model threats, vulnerabilities and mitigations (High) |
| nist-sp-800-218a::PO.2.3 | Leadership commitment to secure development involving AI models (Medium) |
| nist-sp-800-218a::PO.3.1 | Plan automated toolchains that secure AI model development (High) |
| nist-sp-800-218a::PO.3.2 | Deploy, operate and verify the AI security toolchains (High) |
| nist-sp-800-218a::PO.3.3 | Tools generate artefacts evidencing secure AI development, including dataset attestations (Medium) |
| nist-sp-800-218a::PO.4.1 | Security check criteria include guardrails across the AI development life cycle (Medium) |
| nist-sp-800-218a::PO.5.1 | Separate and protect each development environment, including training pipelines and model registries (High) |
| nist-sp-800-218a::PO.5.3 | Continuous monitoring of execution behaviour in development environments hosting AI models (High, new task) |
Produce Well-Secured Software (PW) – NIST SP 800-218A
| Code | Title |
|---|---|
| nist-sp-800-218a::PW.1.1 | Risk modelling that covers AI-specific threats (High) |
| nist-sp-800-218a::PW.3.1 | Analyse data for poisoning, bias, homogeneity and tampering before use (High, new task) |
| nist-sp-800-218a::PW.3.2 | Track data provenance where known and record where it is unknown (Medium, new task) |
| nist-sp-800-218a::PW.3.3 | Include adversarial samples in training and testing data under controlled use (Medium, new task) |
| nist-sp-800-218a::PW.4.1 | Acquire well-secured components, considering reuse of an existing model (High) |
| nist-sp-800-218a::PW.4.4 | Verify integrity, provenance and security of acquired models and components before use (High) |
| nist-sp-800-218a::PW.5.1 | Secure coding practice extended to AI, with careful handling of inputs and outputs (High) |
| nist-sp-800-218a::PW.6 | Build tool security features, with tool versions captured in provenance (PW.6.1 Low, PW.6.2 Medium) |
| nist-sp-800-218a::PW.7.1 | Code review and analysis policies cover AI model code (PW.7.1 Low) |
| nist-sp-800-218a::PW.7.2 | Scan all AI models for malware, vulnerabilities and backdoors (High) |
| nist-sp-800-218a::PW.8.1 | Code testing policies include AI models and the forms of testing to use (High) |
| nist-sp-800-218a::PW.8.2 | Test all AI models for vulnerabilities and retest after retraining or new data (High) |
| nist-sp-800-218a::PW.9.2 | Implement and document secure default settings for model administrators (Medium) |
Protect Software (PS) – NIST SP 800-218A
| Code | Title |
|---|---|
| nist-sp-800-218a::PS.1.1 | Store all code and model elements on least-privilege terms, with reward models and weights kept apart (High) |
| nist-sp-800-218a::PS.1.2 | Protect training, test, fine-tuning and alignment data from unauthorised access and change (High, new task) |
| nist-sp-800-218a::PS.1.3 | Protect model weights and configuration parameters (High, new task) |
| nist-sp-800-218a::PS.2.1 | Provide hashes or signatures for models, components and changes (Medium) |
| nist-sp-800-218a::PS.3.1 | Archive release files with versioned infrastructure tools, model selection rationale and training process records (Low) |
| nist-sp-800-218a::PS.3.2 | Provenance data for models, components, derivatives and the data behind them (Medium, modified task) |
Respond to Vulnerabilities (RV) – NIST SP 800-218A
| Code | Title |
|---|---|
| nist-sp-800-218a::RV.1.1 | Gather vulnerability information, including from model input and output monitoring and AI vulnerability databases (High) |
| nist-sp-800-218a::RV.1.2 | Frequent, largely automated scanning and testing of models, with periodic audits (Medium) |
| nist-sp-800-218a::RV.1.3 | Vulnerability disclosure and remediation policy covers AI models and informs users of limitations (Medium) |
| nist-sp-800-218a::RV.2.1 | Analyse each vulnerability, including deep analysis of model input and output deviations (Medium) |
| nist-sp-800-218a::RV.2.2 | Risk responses that allow for rebuild cost and for stopping or rolling back a model (High) |
| nist-sp-800-218a::RV.3.1 | Root cause analysis supported by after-the-fact review of training and alignment data (Medium) |
What is NIST SP 800-218A and who does it apply to?
NIST SP 800-218A is a compliance framework from United States with 4 domains and 37 controls. NIST's SSDF Community Profile for AI model development: the secure software development tasks that matter most for generative AI and dual-use foundation models, with AI-specific recommendations on environments, protection of weights and training data, provenance, data analysis for poisoning, adversarial testing, model scanning, input and output monitoring, and stopping or rolling back a compromised model. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST SP 800-218A actually require?
NIST SP 800-218A has 37 controls organised across 4 domains. The largest domains are Produce Well-Secured Software (PW) – NIST SP 800-218A (13 controls), Prepare the Organization (PO) – NIST SP 800-218A (12 controls), Protect Software (PS) – NIST SP 800-218A (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST SP 800-218A do I already cover?
NIST SP 800-218A does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement NIST SP 800-218A?
Start your NIST SP 800-218A compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-218A requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 37 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required