Keep a short applicability record: for each SSDF task you skip, write the task ID, the reason it does not apply, who decided, the date, and when you will review it. NIST says some practices are not relevant to every project, and a written reason is what makes a skip defensible.
What NIST says about applicability
SP 800-218 states that "Not all practices are applicable to all use cases; organizations should adopt a risk-based approach to determine what practices are relevant, appropriate, and effective." It gives an example: "if developing a particular piece of software does not involve using a compiler, there would be no need to follow a practice on configuring the compiler to improve executable security."
It adds that some practices are foundational while others "depend on certain foundational practices already being in place," and that practices are "not all equally important for all cases."
The applicability record
| Field | Example entry |
|---|---|
| Task ID | PW.6.1 |
| Task summary | Use compiler, interpreter and build tools that offer features to improve executable security |
| Applies? | Yes for the native agent, no for the static documentation site |
| Reason | The documentation site ships plain static files and has no executable build output |
| Decided by | Engineering lead |
| Date | 2026-10-19 |
| Review trigger | Any new executable component, or annual review |
The ID and wording in this example are only an illustration of the layout. Take real wording from the SSDF table when you fill it in.
Rules for good entries
- Reason in terms of the software, not the effort. "Does not involve a compiler" is an applicability reason. "We have no time" is a gap, and belongs in a plan instead.
- Scope it. A practice may apply to one product and not another. Say which.
- Name the owner. Someone should be able to explain the decision.
- Set a trigger. Skips age badly when the product changes.
- Separate gaps from skips. A gap is a practice that applies but is not yet done. Track it with an owner and date, not in the not applicable list.
Where it helps
- Questionnaires. A buyer asks about a practice you do not follow. You can answer with the record instead of a vague "not applicable." For wording, see how to answer not applicable and compensating control.
- Attestation work. If you consider the CISA form, the record helps you decide where to be specific about scope.
- Audits. An auditor can see that skipped items were considered, not ignored.
Risks to watch
Overuse is the main risk. If half the framework is marked not applicable, a reader will doubt the record. Another is stale entries: a product adds a new language or deployment model and the skip stays on file. Review the record whenever the architecture changes.
Quick check
Is a skipped practice the same as a gap?
No. A skip means the practice does not apply to your software. A gap means it applies and is not yet done.
Who should approve a not applicable decision?
Someone with enough technical context to judge it, such as an engineering or security lead, with the decision recorded and dated.
Sources
Last reviewed: 19 October 2026.
