No. NIST SP 800-218 version 1.1 does not define maturity levels, tiers or scores. It lists practices and tasks, and says the degree and formality of implementation will vary with each producer's security assumptions. If a vendor claims an SSDF level, ask what scale they mean.
Myth versus fact
| Myth | Fact |
|---|---|
| The SSDF has levels 1 to 5 | The publication defines four practice groups and no levels |
| You pass or fail it | No scoring or certificate is defined in the publication |
| Every task applies to every team | NIST says some practices will not be relevant, for example if no compiler is used |
| The table order is the roadmap | NIST says order does not imply sequence or relative importance |
| The examples are required | They are notional implementation examples |
What the text does say
NIST says its practices are not based on the assumption that all organizations have the same security objectives. The expectation is that the degree and the formality of implementation will vary, while the aim is to follow all applicable practices. It also says the audience includes producers regardless of size, sector or level of maturity.
The practices sit in four groups: Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities.
Where the confusion comes from
Other models do define levels, and some vendors map their own scales to SSDF tasks. Those scales belong to whoever publishes them. A statement like "level 3 on SSDF" has no meaning unless the speaker names the scale and what a reviewer saw.
How to describe your depth honestly
Instead of a level, describe each practice with three facts:
- What you do, in one sentence
- Where the evidence lives
- How often it is reviewed
Then add a short list of tasks you have judged not applicable and why. That gives a buyer more information than any number would.
If you want to track progress
Use an internal status for your own planning: not started, in progress, in place, reviewed. Keep it clearly internal, and do not present it externally as a rating. Our related post on documenting practices that do not apply covers the not-applicable list.
A note for buyers
If you are on the buying side, ask suppliers to describe practices rather than claim a level. Good questions are: what do you do for each practice group, can you show a sample, who owns it and when did you last review it. Those four questions work for any size of supplier and need no scoring model. They also surface honest gaps, which tell you more about a supplier than a polished claim does.
Quick check
Can we claim SSDF compliance?
NIST publishes recommended practices, not a certification. Describe what you do and offer evidence, and avoid wording that implies a certificate exists.
Is there an SSDF score we can quote?
Not in the NIST publication. Any score comes from a third party's own method.
Safeguard's compliance and evidence automation can help you keep the per-practice records described above. The free scan is at gold.safeguard.sh/scan.
Sources
- NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1
- NIST CSRC publication page for SP 800-218
Last reviewed: 19 October 2026.
