The Secure Software Development Framework, or SSDF, is a set of core secure software development practices from NIST. Version 1.1 is defined in NIST Special Publication 800-218. It is meant to be added to the development lifecycle you already use, rather than replace it.
Where it came from
NIST says the SSDF is based on established guidance from groups such as BSA, OWASP and SAFECode. It notes that few software development lifecycle models address security in depth, so the framework gives organizations practices to fold into existing models. SP 800-218 replaces the earlier white paper that defined version 1.0 and maps practices to Executive Order 14028, Section 4e.
What it is for
NIST lists four aims:
- reduce the number of vulnerabilities in released software
- limit the impact of vulnerabilities that go undetected
- address root causes so they do not recur
- give producers and buyers a shared vocabulary for procurement and management
That last point is why buyers cite it in questionnaires.
The four practice groups
- Prepare the Organization (PO): get people, processes and technology ready for secure development.
- Protect the Software (PS): guard all software components against tampering and unauthorized access.
- Produce Well-Secured Software (PW): minimize security vulnerabilities in releases.
- Respond to Vulnerabilities (RV): find residual vulnerabilities, respond to them, and prevent similar ones.
Each group contains numbered practices with tasks and examples.
Turning it into something you can show
A framework helps only if you can point to evidence. A workable approach:
- Map your current practices to the groups and note the gaps.
- Pick the gaps with the most effect, such as dependency inventory and vulnerability response.
- Keep artifacts as you go, for example an SBOM per release, build records, and a log of how you handled reported flaws.
- Review the mapping each release cycle.
What it is not
The SSDF is a framework of practices, not a certificate you receive. Whether a particular customer asks you to confirm alignment depends on their contract and rules, so read the actual request instead of assuming.
Safeguard automates evidence collection and applies policies and gates to pipelines. A free scan is at gold.safeguard.sh/scan. For build integrity, see SLSA.
Quick check
Is the SSDF a certification?
No. It is a framework of practices published by NIST. It is not an audit or a certificate.
How many practice groups does it have?
Four: PO, PS, PW and RV.
Sources
Last reviewed: 19 October 2026.
