No. The SSDF, NIST SP 800-218, is a framework of secure development practices. No NIST certificate exists for it in the sources I read. A producer could self-attest to practices drawn from it or use an assessor, and the wording you use publicly should match which of those you did.
Myth vs fact
| Myth | Fact |
|---|---|
| "We are SSDF certified." | NIST describes the SSDF as a core set of high-level practices that can be integrated into any development lifecycle. It is not an assessment program. |
| "The attestation form was an SSDF certificate." | The CISA form was a signed statement by the producer that it makes consistent use of practices derived from the SSDF. A third-party assessment was an alternative path. |
| "Agencies require the form." | OMB M-26-05 rescinded M-22-18 and M-23-16. Agencies may still choose to use the form. |
| "The SSDF is final and frozen." | Version 1.1 is the published version. A draft 1.2 appeared in December 2025 with two added practices, PO.6 and PS.4. |
| "Doing the SSDF means zero vulnerabilities." | NIST says the practices should reduce vulnerabilities in released software and limit the impact of those that remain. |
How to describe what you actually did
| What you did | Accurate wording |
|---|---|
| Follow the practices internally | "Our development process is aligned with NIST SSDF practices." Add which ones. |
| Signed the CISA form for an agency | "We provided a self-attestation to [agency] on [date]." |
| Had an independent assessment | "An independent assessor evaluated conformance on [date]." Name the scope. |
| Nothing formal | Say so, and offer your evidence index. |
Avoid "certified," "compliant with the federal mandate" and "approved." For the self-attestation terms and the criminal statute cited on the form, see the four practice areas.
Why precision matters
The form warned that willfully giving false or misleading information may violate 18 U.S.C. section 1001. Whatever you publish about your own practices should be something you could show a reviewer.
Where to read the source
Start with what NIST SSDF is, then the version history.
Quick check
Can a company be SSDF compliant?
People use the phrase, but there is no official compliance mark in the sources I read. Say "aligned with" and list what you do.
Is the 1.2 draft in effect?
No. It is a draft. The NIST page I read lists only the initial public draft.
Try it yourself
Click through it at your own pace, or open it full screen.
See how evidence maps to a framework without any certificate being implied.
Safeguard provides compliance and evidence automation that maps evidence to frameworks. It does not issue or hold an SSDF certification. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
