PS.4 is a new practice in the draft NIST SSDF 1.2 called "Updates Are Robust and Reliable." It asks producers to test updates, release them in stages, include rollback, and keep update infrastructure dependable, so customers can stay patched without outages. It is draft guidance, not a requirement.
Why a security framework cares about updates
Patching is only a security control if customers can install patches safely. A bad update can cause an outage, and customers then delay the next one. The draft states the goal as helping acquirers "maintain operations and minimize disruptions" by making sure updates are tested and responsibly delivered.
The four tasks
| Task | Plain meaning | Notional example from the draft |
|---|---|---|
| PS.4.1 | Test updates thoroughly before release | Test with configurations and expected customer installations; consider an early access program |
| PS.4.2 | Use tiered release strategies | Canaries, staged roll-out, test deployments, and customer control over which systems get early updates |
| PS.4.3 | Include rollback | Failed updates revert to the last known good configuration; protect against unauthorized rollback to vulnerable versions |
| PS.4.4 | Keep update engines and delivery infrastructure reliable | Make the update engine fault tolerant so it can retry after infrastructure overload |
The last example under PS.4.3 is worth a second look. Rollback helps reliability, but an attacker who can force a rollback can bring back an old vulnerability. The draft names that risk directly.
A decision table for suppliers
| Your product | Questions a buyer may ask |
|---|---|
| Desktop or agent software | Can customers pause or stage updates? Can a bad update undo itself? |
| SaaS | How do you roll out changes, and how do you revert one? |
| Embedded or edge products | Are updates signed, and can a device refuse an older image? |
Evidence worth keeping
- Your release process document, including who approves a release.
- Records of staged rollouts: dates, percentages, and what you watched.
- A rollback test result from a recent release.
- A note on how update packages are signed and verified.
What this does not change
OMB M-26-05 left assurance choices to each agency, so PS.4 does not create a filing duty. It gives you a vocabulary that buyers may borrow in questionnaires. See the attestation timeline for how the earlier documents fit together.
Quick check
Is PS.4 in the current final SSDF?
No. The final version 1.1 does not contain it. It is in the December 2025 draft of version 1.2.
Does PS.4 apply to SaaS?
The draft speaks of customers and software acquirers generally. Staged rollout and rollback are common SaaS practices, so the tasks map across, but confirm any contract wording.
Safeguard provides policies and gates that can block a release when checks fail, plus SBOM and dependency scanning. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
