The Secure Software Development Framework, or SSDF, started as version 1.0 in a NIST Cybersecurity White Paper. Version 1.1 is defined in NIST Special Publication 800-218, which replaced the white paper. It has four practice groups, and it maps to Section 4e of Executive Order 14028.
What the SSDF is
NIST describes it as a set of fundamental, sound and secure software development practices, based on established documents from BSA, OWASP and SAFECode. It is a framework of practices, not a certification you pass.
Versions
- Version 1.0. Defined in a NIST Cybersecurity White Paper.
- Version 1.1. Defined in SP 800-218, posted as final.
- SP 800-218A. A separate publication that adds practices and considerations for generative AI and dual-use foundation model development.
The NIST project page was the source used here, and it does not describe later drafts. If you need current status, check the NIST page directly.
The four practice groups
- Prepare the Organization (PO). Prepare people, processes and technology for secure development.
- Protect the Software (PS). Protect components from tampering and unauthorised access.
- Produce Well-Secured Software (PW). Produce software with minimal vulnerabilities.
- Respond to Vulnerabilities (RV). Identify and respond to residual vulnerabilities, and prevent similar ones.
The link to Executive Order 14028
SP 800-218 includes mappings from Executive Order 14028 Section 4e clauses to SSDF practices and tasks that help address each clause. In version 1.1 these are in Appendix A. The order was signed on 12 May 2021.
How to use it
Treat the four groups as a self review. For each group, write down what you do today and where the evidence lives. That produces a gap list without any new tooling.
A useful order for a small team is to start with the Respond group, since you will need it the day after your first report, then move to Protect, where stolen tokens and unsigned releases are common weak spots.
What the history tells you
The move from a white paper to a numbered special publication gave the SSDF a stable reference that contracts and questionnaires can cite. When you quote it, name the version, since a request that says SSDF may mean 1.0, 1.1 or a later draft. Also note that the AI focused SP 800-218A is an addition, not a replacement, so a team building models may need both documents. Keep a line in your compliance notes recording which version you map to and the date you last checked the NIST page.
Keeping evidence tidy
For each practice group, keep a short folder or page that links to the evidence: policies, pipeline settings, review records and incident handling notes. Date each item. When a customer or assessor asks how you follow the framework, you can show the current state quickly. Avoid claiming full alignment unless you have checked each practice. Saying that you follow selected practices and are working on the rest is accurate and usually more credible than a blanket claim.
Quick check
What does PW stand for?
Produce Well-Secured Software.
Is the SSDF a certification?
No. NIST describes it as a set of development practices.
Safeguard offers compliance and evidence automation that can help you collect proof for practices like these, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
