NIST SP 800-218, the Secure Software Development Framework, offers a common vocabulary for secure development that purchasers can use with suppliers. Use its practice names to ask specific questions, then request evidence for each answer. It is a framework of practices, not a certification a supplier earns.
What the SSDF is
NIST describes SSDF version 1.1, published in February 2022, as a core set of high level practices that can be added to any software development life cycle. It aims to help producers reduce vulnerabilities in released software, limit the damage from those that go undetected, and address root causes. The same abstract says it gives a common vocabulary for secure software development that buyers can use in acquisition and management.
Why a shared vocabulary matters
Without one, a question like "do you build securely?" gets a polished yes. With one, you can ask about a named practice area and what the supplier does in it. It also lets a supplier map one set of evidence to many buyers.
Turning practice areas into questions
| Concern | Question to ask |
|---|---|
| Protecting the build and source | How are code and build environments access controlled and monitored? |
| Producing well secured software | How do you review code and test for vulnerabilities before release? |
| Third party components | How do you assess and track the components you include? |
| Responding to vulnerabilities | How do you receive reports, assess them and ship fixes? |
| Integrity of releases | How can a customer verify a release came from your process? |
These are paraphrased prompts for you to adapt. Check the framework text for exact practice wording before quoting identifiers in a contract.
Using it well
- Pick the practices that match your risk. A supplier with deep network access warrants more.
- Ask for evidence. Policies, build records, scan results, release notes.
- Record the answers in one place and re-ask at renewal.
- Do not treat it as pass or fail. It shows maturity and gaps.
A caution
Some buyers must follow specific attestation rules that reference the SSDF. Those rules have their own scope and dates, so read the current text for your situation instead of relying on a summary.
Worked example
Suppose a supplier claims it manages third party components well. Using the vocabulary, ask how it tracks components, how it learns that one has a problem, how quickly it acts, and how it tells customers. Ask for the last example where it removed or replaced a component, with dates. A supplier that has done this recently will answer quickly and specifically.
Quick check
Is the SSDF a certification?
No. It is a set of practices. A supplier can describe how it meets them, and you can ask for evidence.
Do small suppliers need to follow it fully?
Scale your expectations to access and risk, and ask for a plan where gaps exist.
Where Safeguard fits
Safeguard offers compliance and evidence automation and framework mapping, which can help organize evidence for questions like these. The free scan covers the dependency side.
Sources
Last reviewed: 19 October 2026.
