NIST SP 800-218 Secure Software Development Framework (SSDF)

United States

vv1.1

4 domains

42 controls

NIST SP 800-218 Secure Software Development Framework v1.1.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

PO - Prepare the Organization

13 controls

Controls in the PO - Prepare the Organization domain of NIST SP 800-218 Secure Software Development Framework (SSDF) — 13 controls
Code	Title	Description
PO.1.1	Define Secure Software Development Policies	Define security requirements for software development that align with the organization's risk tolerance, regulatory obli...
PO.1.2	Roles and Responsibilities	Assign and communicate roles and responsibilities for secure software development across product, security, operations,...
PO.1.3	Communicate requirements to third parties providing commercial software components	Convey applicable security requirements to suppliers of commercial, open source, and other third-party software componen...
PO.2.1	Workforce Training	Provide role-based secure software development training to all personnel involved in the SDLC, with refresher training a...
PO.2.2	Provide role-based training for SDLC personnel	Deliver role-specific training on secure development, periodically refresh it, and document completion.
PO.2.3	Foster a security-focused culture and management commitment	Obtain leadership commitment to secure development and embed security culture across teams.
PO.3.1	Toolchain Selection and Implementation	Identify, document, and deploy toolchains that automate and enforce secure development practices across the software lif...
PO.3.2	Toolchain Security and Monitoring	Secure the toolchain itself and continuously monitor its operation, since compromised build infrastructure can poison do...
PO.3.3	Configure tools to generate artifacts of provenance for audit	Ensure tools produce audit-ready artifacts (logs, attestations, build provenance) for compliance and forensic use.
PO.4.1	Security Metrics and Measurement	Define and collect security-related metrics to measure the effectiveness of secure development practices and drive conti...
PO.4.2	Implement processes, mechanisms, etc. to collect and analyze information for criteria	Operationalize the collection and analysis of evidence demonstrating that release criteria are met.
PO.5.1	Secure Software Development Environments	Implement and maintain secure environments for the various stages of the SDLC, including separation between development,...
PO.5.2	Secure and harden development endpoints	Harden developer workstations, build agents, and other endpoints participating in the SDLC.

PS - Protect the Software

4 controls

Controls in the PS - Protect the Software domain of NIST SP 800-218 Secure Software Development Framework (SSDF) — 4 controls
Code	Title	Description
PS.1.1	Protect Source Code Integrity	Protect all forms of code from unauthorised access and tampering by storing it in a secure repository with access contro...
PS.2.1	Software Release Integrity Verification	Provide mechanisms for verifying software release integrity so consumers can confirm the software has not been tampered...
PS.3.1	Archive and Protect Each Release	Archive the necessary files and supporting data for each software release to be able to respond to vulnerabilities, supp...
PS.3.2	Software Bill of Materials (SBOM)	Collect, safeguard, and share provenance data for each software release, including a Software Bill of Materials sufficie...

PW - Produce Well-Secured Software

16 controls

Controls in the PW - Produce Well-Secured Software domain of NIST SP 800-218 Secure Software Development Framework (SSDF) — 16 controls
Code	Title	Description
PW.1.1	Design Software for Security	Use forms of risk modelling, threat modelling, attack surface mapping, or vulnerability analysis to evaluate the design'...
PW.1.2	Track and maintain the software's security requirements, risks, and design decisions	Maintain traceability between security requirements, risks identified, design choices, and implementation.
PW.1.3	Reuse existing, well-secured software when feasible	Prefer vetted internal or external secure components over building new code, with documented evaluation.
PW.2.1	Review and Approve Security Requirements	Review the software design to ensure it complies with the security requirements and risk information.
PW.4.1	Reuse Existing, Well-Secured Software	Acquire and reuse well-secured software components when feasible, evaluating their security before incorporation.
PW.4.2	Create well-secured software components in-house following SDLC processes	When building components internally, follow the SDLC fully so they meet the same security bar as acquired ones.
PW.4.4	Verify acquired commercial, open-source, and other third-party software components	Verify integrity and security of third-party components before integration (signatures, scans, provenance).
PW.5.1	Create Source Code Following Secure Coding Practices	Create source code by following secure coding practices to avoid introducing vulnerabilities, including input validation...
PW.6.1	Configure Compilation and Build Processes	Configure the compilation, interpreter, and build processes to improve executable security by using compiler defences an...
PW.6.2	Determine which compiler, interpreter, and build tool features should be used and how each should be configured	Document and enforce required configuration of compilers, interpreters, and build tooling for security.
PW.7.1	Review and Analyse Human-Readable Code	Review and analyse human-readable code to identify vulnerabilities using peer review and automated static analysis.
PW.7.2	Perform the code review and/or code analysis based on the organization's secure coding practices	Execute code review and SAST per the documented practice and record results and remediation.
PW.8.1	Test Executable Code	Test executable code to identify vulnerabilities and verify compliance with security requirements using dynamic analysis...
PW.8.2	Scope the testing, design the tests, perform the testing, and document the results	Plan, execute, and record dynamic testing including penetration tests, fuzzing, and DAST scans.
PW.9.1	Configure Software with Secure Defaults	Configure software to have secure settings by default to make security the easiest path for users and reduce misconfigur...
PW.9.2	Implement the default settings (or groups of default settings) and document them	Ship secure defaults out-of-the-box and document the rationale and any tradeoffs.

RV - Respond to Vulnerabilities

9 controls

Controls in the RV - Respond to Vulnerabilities domain of NIST SP 800-218 Secure Software Development Framework (SSDF) — 9 controls
Code	Title	Description
RV.1.1	Identify and Confirm Vulnerabilities on an Ongoing Basis	Gather information on potential vulnerabilities in software released by the organization and analyse to determine the ac...
RV.1.2	Review, analyze, and/or test the software's code to identify or confirm vulnerabilities	Validate reported issues by reviewing or testing code to confirm exploitability and scope.
RV.1.3	Have a policy that addresses vulnerability disclosure and remediation	Maintain a coordinated vulnerability disclosure policy aligned to ISO 29147 and remediation per ISO 30111.
RV.2.1	Assess, Prioritise, and Remediate Vulnerabilities	Assess, prioritise, and remediate vulnerabilities, prioritising remediation based on risk to the organization and downst...
RV.2.2	Develop and implement a remediation plan for each vulnerability	Plan and execute the fix (patch, mitigation, or accepted risk) per severity-driven SLAs.
RV.3.1	Analyse Vulnerabilities to Identify Root Causes	Analyse vulnerabilities to identify their root causes and implement preventive practices to address them in future softw...
RV.3.2	Analyze the root causes over time to identify patterns	Look for recurring weakness patterns (CWEs) across releases to drive systemic improvements.
RV.3.3	Review the SDLC to identify changes that could prevent root causes recurring	Feed RCA findings back into the SDLC (tooling, standards, training) to prevent recurrence.
RV.3.4	Inform stakeholders about vulnerabilities, mitigations, and lessons learned	Communicate confirmed vulnerabilities, mitigations, and lessons learned to internal stakeholders and customers.

Frequently Asked Questions

What is NIST SP 800-218 Secure Software Development Framework (SSDF)?

NIST SP 800-218 Secure Software Development Framework (SSDF) is a compliance framework from United States with 4 domains and 42 controls. NIST SP 800-218 Secure Software Development Framework v1.1. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does NIST SP 800-218 Secure Software Development Framework (SSDF) have?

NIST SP 800-218 Secure Software Development Framework (SSDF) has 42 controls organised across 4 domains. The largest domains are PW - Produce Well-Secured Software (16 controls), PO - Prepare the Organization (13 controls), RV - Respond to Vulnerabilities (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does NIST SP 800-218 Secure Software Development Framework (SSDF) map to?

NIST SP 800-218 Secure Software Development Framework (SSDF) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with NIST SP 800-218 Secure Software Development Framework (SSDF) compliance?

Start your NIST SP 800-218 Secure Software Development Framework (SSDF) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-218 Secure Software Development Framework (SSDF) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 768 frameworks.

Get Started Free →

Free forever — no credit card required