The appendix of the CISA form maps its four attestation areas to EO 14028 section 4(e) clauses and to specific SSDF tasks. Secure environments map mostly to PO.5, trusted source code to a wide set of PO, PS, PW and RV tasks, provenance to a similar set, and vulnerability checks to PO.4, PW and RV tasks.
The mapping, simplified
The form's appendix is the source. This table condenses it.
| Form item | EO 14028 clause | SSDF tasks listed |
|---|---|---|
| 1a Separate and protect environments | 4e(i)(A) | PO.5.1 |
| 1b Log and audit trust relationships | 4e(i)(B) | PO.5.1 |
| 1c MFA and conditional access | 4e(i)(C) | PO.5.1, PO.5.2 |
| 1d Document and minimize risky products in the environment | 4e(i)(D) | PO.5.1 |
| 1e Encrypt sensitive data such as credentials | 4e(i)(E) | PO.5.2 |
| 1f Monitor operations and respond to incidents | 4e(i)(F) | PO.3.2, PO.3.3, PO.5.1, PO.5.2 |
| 2 Trusted source code supply chains | 4e(iii) | PO.1.1, PO.3.1, PO.3.2, PO.5.1, PO.5.2, PS.1.1, PS.2.1, PS.3.1, PW.4.1, PW.4.4, PW.7.1, PW.8.1, RV.1.1 |
| 3 Provenance for code and components | 4e(vi) | PO.1.3, PO.3.2, PO.5.1, PO.5.2, PS.3.1, PS.3.2, PW.4.1, PW.4.4, RV.1.1, RV.1.2 |
| 4 Automated vulnerability checks, process, disclosure program | 4e(iv) | PO.4.1, PO.4.2, PS.1.1, PW.2.1, PW.4.4, PW.5.1, PW.6.1, PW.6.2, PW.7.1, PW.7.2, PW.8.2, PW.9.1, PW.9.2, RV.1.1 to RV.1.3, RV.2.1, RV.2.2, RV.3.3 |
What the table tells you
Item 1 is narrow. It sits almost entirely in PO.5, the practice about implementing and maintaining secure environments for software development. If your build and source systems are well controlled, most of item 1 is a settings and access review.
Items 2 and 3 are broad. They touch toolchains, code protection, third party components and code review. They are the ones where teams most often discover that evidence is scattered.
Item 4 is the widest set of tasks, because it spans design review, secure coding, testing, vulnerability handling and the disclosure program.
Using the table for planning
- Copy the table into a sheet and add three columns: owner, evidence location, last checked.
- Fill the narrow rows first, since they are quick wins.
- For the broad rows, start from the SSDF tasks, not the form wording. NIST says its practices are outcomes, not a prescribed toolset.
- Mark tasks that do not apply, for example a compiler configuration task if you ship no compiled code, and record why.
NIST states that the SSDF "does not prescribe how to implement each practice" and that organizations should take a risk-based approach to decide which practices are relevant. The form is narrower than the full framework, so passing the form is not the same as covering every SSDF task.
Try it yourself
Click through it at your own pace, or open it full screen.
See how one control can be linked to several framework requirements at once, then compare that with the table above.
Quick check
Is the mapping part of what the CEO attests to?
No. The appendix says the mapping is provided for reference purposes. The attestation itself is the Section III text.
Does the form cover the whole SSDF?
No. It selects best practices from SP 800-218 and lists the tasks related to each item. The full framework has more.
Sources
Last reviewed: 19 October 2026.
