PR.PS-06 states: "Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle". Show integration with pipeline checks and review rules, and show monitoring with trend data over time. Having the practices without measuring them covers half the sentence.
Two halves of one sentence
Subcategory PR.PS-06 belongs to the Protect function, in the Platform Security category of NIST CSF 2.0. The wording has two halves. Integrated means practices are built into how code is written, reviewed, tested and released. Monitored means you track how well they perform across the life cycle.
CSF outcomes do not say which practices to choose. NIST's Secure Software Development Framework is a separate publication that many teams use as a source of practices, but this post only relies on the CSF text.
Evidence for integration
| Practice | Artifact |
|---|---|
| Code review | Branch protection settings requiring approval |
| Automated testing | CI configuration and run history |
| Static and dependency checks | Pipeline steps and stored results |
| Security requirements | Design review notes or requirement tickets |
| Release control | Protected release workflow with approvals |
| Training | Completion records for developers |
Settings exports show the rule exists. Run history shows it fired. Together they show integration, not just intent.
Evidence for monitoring
Monitoring needs numbers or reviews over time. Choose a few measures and keep them for several periods.
- Share of repositories with required checks enabled.
- Number of builds blocked by a policy and how many were later fixed.
- Median time from finding to fix by severity.
- Share of releases with a stored SBOM.
- Count of policy exceptions open and their age.
Review the numbers on a schedule, record decisions such as turning on a check for more repositories, and keep the notes. A chart with no decision attached shows measuring but not acting.
Practical start
Begin with the repositories that hold your most important services. Apply the full set of checks there, record the baseline, then roll out. Report coverage honestly, including the repositories that lag. Coverage you can see is better evidence than a claim that everything is covered.
Try it yourself
Open the pull request gate demo and see a policy hold a change until checks pass. That is the integrated part of PR.PS-06 in action.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard supports policies, gates and guardrails on pull requests, plus compliance and evidence automation, so gate outcomes can be kept as records. You can try the free scan at gold.safeguard.sh/scan. Treat any export as input to your own review, not as a finding of compliance.
Quick check
Is PR.PS-06 the same as NIST SSDF?
No. PR.PS-06 is a CSF 2.0 outcome. The SSDF is a separate publication that can supply practices to meet it.
What counts as monitoring performance?
Any regular review of measures such as coverage, time to fix or blocked builds, with recorded decisions from the review.
Sources
Last reviewed: 19 October 2026.
