Compliance & Regulations/North America/SSDF
Product Security · United States (Federal); CISA self-attestation form required for federal software vendors

NIST SP 800-218 (SSDF)

The Secure Software Development Framework that backs EO 14028, the CISA attestation form, and most modern software supply-chain mandates.

Regulator
National Institute of Standards and Technology
Jurisdiction
United States (Federal); CISA self-attestation form required for federal software vendors
Status
v1.1 (final).
In force since
February 2022 (v1.1); CISA attestation form required for federal software since June 2023.
Regulator's source
Who it applies to

Any software producer selling into the US federal government, plus voluntary adoption worldwide.

Audit / certification status

Safeguard's own SSDF attestation is published on the trust center.

What it requires

What SSDF actually requires.

These are the obligations a regulated entity owes — the things an assessor or supervisor will ask about.

01

Prepare the Organization (PO): defined SDLC, security training, threat models per product.

02

Protect the Software (PS): code signing, integrity verification of source and build environment.

03

Produce Well-Secured Software (PW): SAST/SCA, secure design reviews, secret scanning.

04

Respond to Vulnerabilities (RV): coordinated disclosure, vulnerability remediation SLA, customer notification.

How Safeguard maps to it

Pre-mapped controls. Continuous evidence.

Each requirement above is bound to live telemetry — not screenshots. The mapping below is what your auditor or regulator sees.

Full crosswalk of all 19 SSDF tasks to live telemetry and signed evidence.

Build provenance (SLSA L3) and source provenance attestations generated automatically.

Secret scanning + SAST + SCA findings surfaced to product owners with remediation SLAs.

Coordinated disclosure workflow with VEX publication for downstream consumers.

Hardware-isolated build environments and signed artifact storage available out of the box.

Evidence we produce

Artifacts your auditor accepts.

Each evidence artifact is signed and timestamped. Auditors can verify integrity without trusting Safeguard.

CISA Self-Attestation Form pre-populated from live telemetry.

Per-product threat model linkage to control attestation.

Build provenance (in-toto, SLSA L3) for every signed release.

VEX records for downstream consumers per CVE response cycle.

Ready for SSDF?

Bring the framework. We'll walk the controls with you — section by section, evidence packet by evidence packet, with the regulators you actually have to answer to.

Safeguard | Software Supply Chain Security Platform | Zero CVE + Self-Healing