NIST SSDF is a framework of recommended practices, and SLSA is a set of levels describing build integrity. Neither is a certificate a vendor can simply hold. When a page says "compliant" or "aligned", ask which practices or which level, for which product, assessed by whom and when, with evidence you can read.
What the documents are
NIST's Secure Software Development Framework, published as SP 800-218, describes itself as a core set of high-level secure software development practices that can be integrated into each software development lifecycle. It adds that purchasers can use it as a common vocabulary with suppliers. It recommends practices. It does not issue certificates.
SLSA, in its version 1.0 specification, is organised into levels that provide increasing supply chain security guarantees, split into tracks. The Build track has levels from L0 to L3: no guarantees, provenance exists, a hosted build platform, and hardened builds. The page calls itself a descriptive overview, with prescriptive requirements elsewhere.
Both are useful, and both are easy to cite loosely.
Words to read carefully
| Phrase on a page | What to ask |
|---|---|
| "Compliant with SSDF" | Against which practices, assessed by whom? Is there a written self assessment? |
| "Aligned with SSDF" | Which practices are not yet met? |
| "SLSA level 3" | Which track, which product and build pipeline, and how is it verified? |
| "Follows supply chain best practices" | Which ones, named and evidenced? |
| "Certified" | Certified by which body, under which scheme? Frameworks like these are not certification schemes by themselves. |
Precision is a good sign. Vague words near a framework name are a prompt for questions.
Evidence worth asking for
- A practice by practice mapping, with the artefact for each: a policy, a pipeline configuration, a log, a test report.
- For SLSA, a sample provenance file for a recent release, and the steps to verify it with a tool you choose.
- The scope: which products, repositories and build systems are covered, and which are not.
- The date of the last review and who performed it.
- How exceptions are tracked and closed.
If a US government customer asks you for a secure development attestation, that is a separate document with its own form and process. A vendor page claiming alignment is not the same thing, and you should ask which one you are being offered.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a control maps to evidence, and notice that a mapping is a claim until the evidence behind each line is checked.
Where Safeguard fits
Safeguard provides compliance and evidence automation and framework mapping to help teams assemble this kind of evidence. It does not make a framework a certificate, and you should ask the same questions of any vendor, Safeguard included.
Quick check
Can a vendor be SSDF certified?
SSDF is a framework of practices. Ask what assessment is claimed and who performed it, rather than assuming a certificate exists.
Does a SLSA level cover the whole company?
No. It applies to a specific build pipeline and artefact. Ask which ones.
Sources
- NIST SP 800-218, Secure Software Development Framework Version 1.1, accessed 19 October 2026.
- SLSA specification v1.0, Security levels, accessed 19 October 2026.
Last reviewed: 19 October 2026.
