NIST's Secure Software Development Framework organizes its practices into four groups: Prepare the Organization, Protect the Software, Produce Well-Secured Software, and Respond to Vulnerabilities. For an AppSec program lead, the groups work as a map of what a program should cover, whether or not anyone is asking you to attest.
What SSDF is
NIST SP 800-218 recommends the SSDF, described as a core set of high level secure software development practices that can be added to any software development lifecycle model. The final version 1.1 was published in February 2022.
It is a framework of outcomes, not a tool list. How you meet each practice is up to you.
The four groups
Prepare the Organization (PO). Get people, processes and technology ready for secure development, across the organization and for specific teams or projects. For a program lead this is where champions, training, roles, policies and toolchains live.
Protect the Software (PS). Protect all parts of the software from unauthorized change or access. Think source code access, build integrity, release signing and storing what you ship.
Produce Well-Secured Software (PW). Build releases with as few vulnerabilities as possible. Design review, threat modeling, secure coding, code review and testing belong here.
Respond to Vulnerabilities (RV). Find vulnerabilities that remain in releases, address them and prevent similar ones in the future. Intake of reports, triage, fixing and root cause analysis sit in this group.
Using the groups as a self check
Make a four row table. For each group, list what your program does today, who owns it and what evidence exists. Gaps are usually easy to spot. Many programs are strong in Produce and Respond, with thin Prepare and Protect.
Where this program's topics land
- Security champions and training: Prepare.
- Threat modeling and design review: Produce.
- Build and source protections: Protect.
- Vulnerability intake and triage: Respond.
Careful with claims
Do not describe a framework alignment as certification. SSDF is guidance. If a customer asks about it, answer with the practices you perform and the evidence you can show. Whether a particular buyer asks for an attestation depends on that buyer and their contract.
Evidence and mapping
Mapping practices to evidence is tedious by hand. Safeguard offers compliance and evidence automation, and a framework mapping demo shows the idea.
Click through it at your own pace, or open it full screen.
Turning the table into a plan
For each group, choose one improvement for the next quarter. Prepare: write down who owns what and add one training session. Protect: review who can change production code. Produce: run a threat model on your riskiest feature. Respond: test your vulnerability intake path end to end. Four small steps, one per group, give a balanced program without a large project.
Quick check
Is SSDF a certification?
No. It is a NIST framework of practices. Treat it as a guide for your program.
Sources
Last reviewed: 19 October 2026.
