PO.6 is a new practice in the draft NIST SSDF version 1.2, titled "Define and Implement a Continuous Process Improvement Plan." It asks a software producer to improve its development environments, tools and vulnerability response over time. It is a draft recommendation, not a mandate and not a certification.
Definitions first
SSDF is the Secure Software Development Framework, NIST SP 800-218. It is a set of high-level practices that can be built into any development lifecycle.
Initial public draft means NIST has published text for comment but has not finalized it. NIST published SP 800-218 Rev. 1 as an initial public draft on 17 December 2025, and comments closed on 30 January 2026. The NIST page I read on 19 October 2026 lists only that draft, so check the page for a final version before you cite it.
What PO.6 contains
NIST says two practices were added in this draft: PO.6 and PS.4. PO.6 has three tasks.
| Task | What it asks, in plain words | Example NIST gives |
|---|---|---|
| PO.6.1 | Update and improve development environments as new threats appear and new tools are added | Add or reconfigure scanning tools to check artifacts received from suppliers for malicious content |
| PO.6.2 | Find new processes, tools and techniques that help avoid software errors | Use languages or language features that remove classes of vulnerabilities |
| PO.6.3 | Improve vulnerability response and review earlier decisions | Periodically review a decision not to ship an update in favor of another mitigation |
The examples are "notional." NIST presents them as ideas, not a checklist you must complete.
What it means for a supplier
Many agencies and prime contractors ask how a supplier keeps its practices current. PO.6 gives that question a name. A supplier that can show dated changes to its pipeline has a concrete answer.
Useful evidence is ordinary engineering output:
- A changelog for your build and scanning configuration, with dates and reasons.
- Post-incident or post-release reviews that led to a tooling change.
- A record of risk acceptance decisions and when they were last reviewed.
- A short roadmap item list for removing a class of bugs, such as a memory safety plan.
What PO.6 is not
It is not a new attestation form. After OMB M-26-05 rescinded M-22-18 and M-23-16, each agency decides what assurance it wants. See what changed for suppliers. A draft practice also cannot be cited as a binding duty in a contract unless the contract itself says so.
A simple way to start
Pick one improvement per quarter, write down why you made it, and keep the pull request or ticket. Four dated entries a year is a better story than a single large policy document. For the rest of the framework, see what NIST SSDF is.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how new findings appear after the first scan. That ongoing signal is what a continuous improvement plan acts on.
Quick check
Is PO.6 final?
No. It appears in an initial public draft. Check NIST's page for the current status.
Does PO.6 require a particular tool?
No. The examples describe kinds of improvements, and the draft leaves tool choice to the producer.
Safeguard offers SBOM and dependency scanning, policies and gates, and compliance and evidence automation, which can help keep dated records of pipeline changes. You can run a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
