SCSIC: Vendor Software Delivery Integrity Controls · SP80053: SA-3(1), SA-8, SA-15 · SP800161: SA-3, SA-8, SA-15 · SP800181: OM-NET-001, SP-SYS-001; T0019, T0023, T0144, T0160, T0262, T0438, T0484, T0485, T0553; K0001, K0005, K0007, K0033, K0049, K0056, K0061, K0071, K0104, K0112, K0179, K0326, K0487; S0007, S0084, S0121; A0048 · NIST SP 800-218 ·

May 11, 2026 - SSDF (NIST SP 800-218) is a practice framework for how software is built and answers "did you follow secure development practices?" SLSA (Supply-chain Levels for Software Artifacts, now at v1.0 under the OpenSSF) is a build-integrity ladder ...

implementation examples and informative ... in SP 800-218 for additional · information on how to perform each SSDF practice and task for all types of software · development, as they are also generally applicable to AI model and AI system development. ... Improving the Nation’s Cybersecurity [7], to enhance software supply chain security. • NIST general cybersecurity resources, including The NIST Cybersecurity Framework (CSF) 2.0 [8], Security and Privacy Controls for Information ...

Flexibility: High (Provides practices and tasks, not rigid controls; adaptable to various SDLC models like Agile, Waterfall, DevOps). Audit Intensity: Moderate (No formal certification, but requires self-attestation for federal suppliers; assessments focus on demonstrating implementation of the practices). NIST Special Publication 800-218...

April 8, 2026 - Learn the key aspects of NIST SPs 800-34, 800-61, 800-63, and 800-218 and how they guide security for federal organizations.

September 30, 2021 - SCSIC: Vendor Sourcing Integrity Controls · SP80053: SA-4, SA-9, SA-12, SR-5 · SP800160: 3.1.1, 3.1.2 · SP800181: T0203, T0415; K0039; S0374; A0056, A0161 · NIST SP 800-218 (DRAFT) SSDF VERSION 1.1 · 6 · Practices · Tasks · Implementation Examples · References ·

February 3, 2022 - Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) – a core set of high-level secure software development practices that can be integrated into each SDLC implementation.

April 26, 2026 - NIST SP 800-218 is the Secure Software Development Framework (SSDF) v1.1, published by NIST in February 2022. After Executive Order 14028 and OMB Memorandum M-22-18, federal software suppliers must self-attest to conformance with SSDF practices. Beyond government, banks, healthcare, and large commercial buyers now reference SSDF in vendor risk questionnaires.

May 8, 2026 - NIST SP 800-218, the Secure Software Development Framework, was published in February 2022 to replace and consolidate the older fragmented body of NIST secure development guidance.

This document outlines how our capabilities align with EO 14028 Section 4 (“Enhancing Software Supply Chain Security“) and the authoritative requirements of NIST SP 800-218, including the ability to create, ingest, and continuously monitor SBOMs (Software Bill of Materials).

January 31, 2024 - Using automated evidence collection and continuous monitoring, together with a full suite of customizable policies and controls as a compliance foundation, our compliance automation platform and services help our customers become compliance-ready for NIST’s 800–218 Secure Software Development ...

March 24, 2026 - As mandated in the “cybersecurity EO,” the Federal Acquisition Regulation (FAR) Council will soon draft new regulations requiring all software suppliers to the US government to self-attest to compliance with NIST 800-218, released in February 2022.

May 13, 2026 - AI/ML producers overlooking data provenance and model integrity where SP 800-218A applies. The SSDF is intentionally interoperable. The mapping below helps organisations reuse existing controls and evidence when they operate multiple frameworks. ... As a CERT-In empanelled auditor and PCI QSA, CyberSigma runs end-to-end NIST SSDF engagements: gap assessment against every PO/PS/PW/RV practice, secure-SDLC and DevSecOps pipeline design (SAST, SCA, DAST, secrets scanning, SBOM and code signing), threat-modelling and PSIRT stand-up, SP 800-218A readiness for AI producers, and full support for US federal self-attestation and third-party assessment.

NIST SP 800-218, Secure Software Development Framework V1.1: Recommendations fo… · Related topics: Information and Communications Technology Supply Chain Security · This document describes a set of fundamental, sound practices for secure software development called the Secure Software Development Framework (SSDF).

April 29, 2024 - This document augments the secure software development practices and tasks defined in Secure Software Development Framework (SSDF) version 1.1 by adding practices, tasks, recommendations, considerations, notes, and informative references that are specific to AI model development throughout ...

March 3, 2022 - Review the Design (PW.2). It’s sort of obvious, but having a second (or third) set of eyes reviewing a high level design, especially when dealing with sensitive data or complicated security controls, can help catch costly mistakes early.

July 26, 2024 - This document augments the secure software development practices and tasks defined in Secure Software Development Framework (SSDF) version 1.1 by adding practices, tasks, recommendations, considerations, notes, and informative references that are specific to AI model development throughout the software development life cycle.

February 3, 2026 - We are now seeing indicators of how the US Government intends to drive the changes they believe are necessary. One of the requirements they are implementing is that all software vendors attest that they developed their software in accordance with NIST 800-218, the Secure Software Development Framework, or SSDF.

December 17, 2025 - Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model. SP 800-218 recommends the Secure Software Development Framework (SSDF), which is a core set of high-level secure ...