NIST SP 800-218
Secure Software Development Framework (SSDF)
NIST SP 800-218 is a compliance framework from United States with 8 domains and 42 controls that map to 27 other frameworks. The largest domains are Prepare the Organization (8 controls), Produce Well Secured Software (8 controls), NIST SP 800-218: Access Control (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
NIST SP 800-218: Access Control
Logical and physical access controls (NIST SP 800-218)
| Code | Title |
|---|---|
| SP800-218-PW.7.2 | Perform Code Review and Analysis |
| SP800-218-PW.8.2 | Execute Security Testing |
| SP800-218-PW.9.2 | Implement and Document Secure Defaults |
| SP800-218-RV.1.2 | Review and Analyze Code for Vulnerabilities |
| SP800-218-RV.1.3 | Vulnerability Disclosure Policy |
NIST SP 800-218: Asset Management
Information asset management (NIST SP 800-218)
| Code | Title |
|---|---|
| SP800-218-PW.1.2 | Track Security Requirements, Risks, and Decisions |
| SP800-218-PW.1.3 | Support Standardized Security Features |
| SP800-218-PW.2.1 | Qualified Review of Software Design |
| SP800-218-PW.4.2 | Maintain Well-Secured In-House Components |
| SP800-218-PW.6.2 | Configure Build Tool Security Features |
NIST SP 800-218: Cryptography
Cryptographic controls (NIST SP 800-218)
| Code | Title |
|---|---|
| SP800-218-RV.2.2 | Develop and Implement Remediation Plans |
| SP800-218-RV.3.2 | Identify and Fix Similar Vulnerabilities |
| SP800-218-RV.3.3 | Review SDLC to Prevent Recurrence |
| SP800-218-RV.3.4 | Document Lessons Learned |
NIST SP 800-218: Information Security Policies
Organizational information security policies (NIST SP 800-218)
| Code | Title |
|---|---|
| SP800-218-PO.1.3 | Communicate Requirements to Third-Party Providers |
| SP800-218-PO.2.3 | Obtain Management Commitment to Secure Development |
| SP800-218-PO.3.3 | Toolchain Generates Security Artifacts |
| SP800-218-PO.4.2 | Gather and Safeguard Security Check Information |
| SP800-218-PO.5.2 | Harden Development Endpoints |
Prepare the Organization
| Code | Title |
|---|---|
| SP800-218-PO.1.1 | Define Security Requirements for Software Development |
| SP800-218-PO.1.2 | Implement Security Requirements in the Toolchain |
| SP800-218-PO.2.1 | Roles and Responsibilities for Secure Development |
| SP800-218-PO.2.2 | Training and Skills Maintenance |
| SP800-218-PO.3.1 | Supporting Toolchain Selection |
| SP800-218-PO.3.2 | Toolchain Configuration and Integration |
| SP800-218-PO.4.1 | Criteria for Software Security |
| SP800-218-PO.5.1 | Secure Development Environment Implementation |
Produce Well Secured Software
| Code | Title |
|---|---|
| SP800-218-PW.1.1 | Design Software to Meet Security Requirements |
| SP800-218-PW.4.1 | Reuse Trusted Software Components |
| SP800-218-PW.4.4 | Verify Acquired Components Meet Security Requirements |
| SP800-218-PW.5.1 | Secure Coding Practices |
| SP800-218-PW.6.1 | Configure Compilation and Build Processes Securely |
| SP800-218-PW.7.1 | Code Review |
| SP800-218-PW.8.1 | Executable Testing for Security |
| SP800-218-PW.9.1 | Configure Software to Have Secure Settings by Default |
Protect the Software
| Code | Title |
|---|---|
| SP800-218-PS.1.1 | Protect All Forms of Code from Unauthorized Modification |
| SP800-218-PS.2.1 | Provide a Mechanism for Verifying Software Release Integrity |
| SP800-218-PS.3.1 | Archive and Protect Released Software |
| SP800-218-PS.3.2 | Software Bill of Materials |
Respond to Vulnerabilities
| Code | Title |
|---|---|
| SP800-218-RV.1.1 | Identify and Confirm Vulnerabilities on an Ongoing Basis |
| SP800-218-RV.2.1 | Assess, Prioritize, and Remediate Vulnerabilities |
| SP800-218-RV.3.1 | Analyze Vulnerabilities to Identify Root Causes |
Your Compliance Coverage
If you comply with NIST SP 800-218, you already cover:
C5 (Germany)
100%
42 controls mapped
Compare →NIST SP 800-161 Rev 1
100%
42 controls mapped
Compare →NIST SP 800-53 Rev 5
100%
42 controls mapped
Compare →+ 24 more: ISO 27002:2022 (100%), NIST Cybersecurity Framework 2.0 (100%)
See all 27 mapped frameworks ↓Maps to 27 other frameworks
What is NIST SP 800-218 and who does it apply to?
NIST SP 800-218 is a compliance framework from United States with 8 domains and 42 controls. Secure Software Development Framework (SSDF) It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does NIST SP 800-218 actually require?
NIST SP 800-218 has 42 controls organised across 8 domains. The largest domains are Prepare the Organization (8 controls), Produce Well Secured Software (8 controls), NIST SP 800-218: Access Control (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of NIST SP 800-218 do I already cover?
NIST SP 800-218 maps to 27 other compliance frameworks. The top mapping partners are C5 (Germany) (100% coverage), NIST SP 800-161 Rev 1 (100% coverage), NIST SP 800-53 Rev 5 (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement NIST SP 800-218?
Start your NIST SP 800-218 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-218 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required