Use both, for different questions. NIST SP 800-218, the SSDF, lists secure development practices, so ask a vendor which they follow and can evidence. CISA's Secure by Design asks about ownership and transparency, so ask how the vendor treats customer security outcomes. One covers how software is built, the other how the vendor behaves.
What each document is
NIST describes SP 800-218 version 1.1, published in February 2022, as a core set of high-level secure software development practices that can be built into any development life cycle model. Its stated aims are to reduce vulnerabilities in released software, limit the impact of those that go undetected, and address root causes. It also gives purchasers and suppliers a shared vocabulary.
CISA's Secure by Design guidance lists three principles: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top.
Neither is a certification. Neither produces a pass or fail mark on its own. Be wary of any vendor claiming it.
A side by side
| SSDF | Secure by Design | |
|---|---|---|
| Focus | Development practices | Vendor principles |
| Typical question | "Which practices do you follow and how do you show it?" | "What do you do when a customer is at risk?" |
| Evidence | Process records, pipeline output, reviews | Advisories, defaults, disclosure history |
| Audience | Engineering and procurement | Executives and product owners |
Questions drawn from SSDF
- Which development practices do you map to the SSDF, and where is the evidence?
- How do you check the integrity of third party components before use?
- How do you find and fix vulnerabilities before release?
- How do you handle reports after release?
Ask for a mapping, not a statement. A mapping with gaps marked is more believable than a full set of ticks.
Questions drawn from Secure by Design
- Who in the executive team owns product security?
- How do you publish and correct vulnerability information?
- Which security features are on by default, and which cost extra?
- Can you show a recent case where you changed a product because of a security finding?
A practical sequence
- Send the SSDF questions to engineering and collect evidence.
- Send the Secure by Design questions to the product lead.
- Compare the two. A vendor whose engineers describe real practices and whose executives describe the same ones is consistent. A gap between them is information.
If a procurement process cites a specific federal attestation form, read the exact text of that form for the requirement, and ask counsel. Do not assume a framework is a mandate.
Try it yourself
Open the demo to see how practices are mapped to a framework and where evidence is attached. Look at the gaps the mapping reveals.
Click through it at your own pace, or open it full screen.
Safeguard's compliance and evidence automation helps teams map their controls to frameworks and keep supporting records, and a free scan feeds the dependency side of that evidence.
Quick check
Is SSDF compliance a certification?
No. NIST publishes the framework. It does not issue a mark. Be careful with any claim of an SSDF badge.
Which one do small vendors find easier?
Many find the principles easier to describe and the practices harder to evidence. Start with the practices you already operate.
Sources
Last reviewed: 19 October 2026.
