NIST SP 800-218 says that when software is delivered through infrastructure, platform, software, container or serverless services, responsibility for SSDF practices likely follows a shared responsibility model. The tenant should agree with each provider which party owns each practice and task, and how the provider will attest to conformance.
What the SSDF says
The framework states: "The responsibility for implementing the practices may be distributed among different organizations based on the delivery of the software and services (e.g., infrastructure as a service, software as a service, platform as a service, container as a service, serverless). In these situations, it likely follows a shared responsibility model involving the platform/service providers and the tenant organization that is consuming those platforms/services."
It then gives the advice: "The tenant organization should establish an agreement with the providers that specifies which party is responsible for each practice and task and how each provider will attest to their conformance with the agreement."
Building a responsibility split
Take the SSDF task list and put it in a sheet with columns for you, the provider and both. Some tasks land clearly on one side:
| Area | Often yours | Often the provider's | Often shared |
|---|---|---|---|
| Your application code and review | Yes | ||
| Hardening of the underlying infrastructure | Yes | ||
| Build pipeline configuration and secrets | Yes | Depends on the CI service | |
| Access to your build environment | Yes | Provider controls the identity layer | |
| Vulnerability handling in your dependencies | Yes | ||
| Vulnerability handling in the platform itself | Yes | You track advisories |
This table is an illustration of how to think about it, not a ruling for any provider. Your own agreement and the provider's documentation decide the real answer.
Asking providers to attest
The SSDF says the agreement should state how each provider will attest. In practice that could mean:
- A written statement in the contract on which practices the provider operates.
- A report or summary the provider shares under NDA.
- A named contact for conformance questions.
- A commitment to tell you when a relevant practice changes.
Keep copies with your own evidence. When a buyer asks you about a practice that sits with your cloud provider, you can point to the agreement and the provider's statement instead of guessing.
Where this matters for attestation work
The CISA form's Section III asks the software producer to attest to practices in building its software. If your build runs on a hosted CI service, items such as separated environments and MFA are partly delivered by that service. You are still the one signing, so you need to know what the provider does and what you configure yourself. A split table is the quickest way to find the gaps.
Common mistakes
- Assuming the provider's compliance report covers your own configuration.
- Not recording the split, so each new buyer question restarts the research.
- Forgetting to revisit when you change providers or add a managed service.
Quick check
Does using a cloud provider move SSDF responsibility entirely to them?
No. NIST describes a shared model, and the tenant should agree with each provider on who is responsible for each practice and task.
What should the provider agreement include?
Which party owns each practice and task, and how each provider will attest to its conformance.
Sources
- NIST SP 800-218, Secure Software Development Framework version 1.1
- CISA Secure Software Attestation common form
Last reviewed: 19 October 2026.
