The SSDF, NIST Special Publication 800-218, is a set of high level secure software development practices. Procurement teams mention it because it gives buyers and suppliers a shared vocabulary for discussing how software is built, without prescribing a single method or tool.
What it is
NIST describes the Secure Software Development Framework as a core set of high level secure software development practices that can be built into any software development life cycle model. Its stated aims are to help producers release software with fewer vulnerabilities, limit the damage from flaws that go undetected or unfixed, and address root causes so they do not recur.
Who it is for
Software producers are the primary audience. NIST also says buyers and users can use it, and that purchasers and consumers can apply the shared vocabulary to communicate with suppliers during procurement and other management activities.
Why it shows up in buying
CISA publishes a Secure Software Development Attestation Form that is a self attestation based on selected practices from SSDF version 1.1. The page names software producers and federal agencies as its audience. It also notes agencies may require software producers to provide an SBOM on request. A self attestation is a producer's own statement, which differs from an independent audit or a certification.
How a buyer can use it without being a specialist
Use SSDF language to turn a vague question into specific ones.
- How do you find and fix vulnerabilities in your own code?
- How do you check the third party components you include?
- How do you protect your build and release environment?
- How do you respond when a flaw is reported?
Ask for a short written answer to each, and for evidence you can see, such as a sample report or process description.
What it does not do
SSDF is guidance. A supplier saying they follow it is a claim you can test, not a guarantee. Read answers for detail. Specific, checkable statements are more useful than general reassurance.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, policies and gates, and compliance and evidence automation that can help teams collect the material buyers ask for. You can run a free scan on a repository.
Quick check
Is the SSDF a certification?
No. It is a framework of practices. NIST publishes it as guidance, and CISA's form is a self attestation.
Do private companies use it?
Yes, buyers outside government can use its vocabulary too, since NIST says purchasers and consumers can apply it in procurement.
Sources
- NIST SP 800-218, Secure Software Development Framework
- CISA, Secure Software Development Attestation Form
Last reviewed: 19 October 2026.
