The NIST Secure Software Development Framework, or SSDF, is a set of secure software development practices defined in NIST SP 800-218. It is a framework of practices, not a certification. For a new AppSec engineer it works as a map of what a secure development program does across the lifecycle.
What NIST says it is for
NIST describes the SSDF as practices based on established guidance from organizations such as BSA, OWASP and SAFECode. Following them should help software producers reduce the number of vulnerabilities in released software, limit the impact of vulnerabilities that go undetected, and address root causes so problems do not recur. It also gives producers and acquirers a shared vocabulary for procurement.
The current version on the NIST page is SSDF 1.1, defined in SP 800-218, posted as final. A companion document, SP 800-218A, is a community profile for generative AI and dual-use foundation models. NIST says it is considering future additions, such as an online reference repository and DevSecOps guidance.
The four groups
| Group | Plain meaning | Example AppSec work |
|---|---|---|
| Prepare the Organization | Roles, training, tooling, policy | Writing a secure coding standard |
| Protect the Software | Keep code and build safe from tampering | Access control on repositories, signing releases |
| Produce Well-Secured Software | Design, code and test securely | Threat modeling, code review, scanning |
| Respond to Vulnerabilities | Find, triage and fix issues over time | Advisory intake, patching, disclosure |
How to use it as a learner
Use the groups as a checklist for your own portfolio project. Can you show one artifact for each group?
- Prepare: a short security policy file for your repository.
- Protect: branch protection and a note on who can publish.
- Produce: a scan result and a fixed finding.
- Respond: a documented way for someone to report a flaw.
That four item set is small enough to finish in a weekend, and it gives you a concrete answer when an interviewer asks what secure development means to you.
What it is not
SSDF is not a product you buy or a badge you receive. Be careful in conversation: saying a team follows SSDF practices is different from claiming an attestation or certification. Those words have specific meanings, and mixing them up in an interview or a customer call costs credibility. Our post, is SSDF compliance a certification, goes through it.
Try it yourself
Open the demo to see findings mapped to framework controls, which is how evidence for practices like these is organized.
Click through it at your own pace, or open it full screen.
Reading the source document
When you read SP 800-218 itself, expect a table of practices, each with tasks and notes. Do not try to read it cover to cover. Pick one practice per week, find a real example of it in an open source project you use, and note what evidence exists, such as a policy file or a release process.
Quick check
Is SSDF a certification?
No. It is a framework of practices published by NIST.
Which version is current?
The NIST page lists SSDF 1.1 in SP 800-218 as final. Check the page for updates.
Sources
Last reviewed: 19 October 2026.
