NIST SSDF (SP 800-218): Secure Software Development Framework

Practice groups

• Prepare the organisation (PO)
• Protect the software (PS)
• Produce well-secured software (PW)
• Respond to vulnerabilities (RV)

Mapping to engineering

Link CI/CD gates, code review, SCA/SAST results, and vulnerability SLAs into SSDF practice IDs.

Evidence

Pipeline configs, signed builds, SBOM generation records, and incident lessons learned.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is SSDF a certification?

No — it is a practice framework; attestations are organisational claims.

Relation to ISO 27001?

Overlaps secure development themes; keep SSDF IDs for US buyers.

Open source?

Include dependency and maintainer risk in PW/RV practices.

Related Resources

• NIST hub
• CSA