Put NIST SSDF secure development practices into action, with evidence
The NIST SSDF (Secure Software Development Framework, NIST SP 800-218) is a set of fundamental, outcome-based practices for building software securely and reducing vulnerabilities across the software development life cycle. Version 1.1, published in February 2022, defines 19 practices and 42 tasks in four groups. It describes what to achieve rather than prescribing specific tools or methods, so it fits any development model.
Is NIST SSDF right for your organisation?
The SSDF is most relevant to software producers that sell to US federal agencies, which have used it as the basis for secure software development attestations, and to their subcontractors. It is also widely adopted voluntarily by SaaS and software companies that want a recognised benchmark for secure development to show customers. Buyers use it to frame supplier security questions.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST)
- Current final version
- SSDF version 1.1 (SP 800-218), February 2022
- In development
- SSDF version 1.2 (SP 800-218 Rev. 1), draft published December 2025
- Structure
- 19 practices and 42 tasks in 4 groups (PO, PS, PW, RV)
- Requirement
- Voluntary framework; US federal agencies may require supplier assurance based on it
- Assessment route
- No certification; organisations self-assess or provide attestation to customers
- Type
- Framework (voluntary)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
The NIST SSDF is mapped in OneClickComply's control library and is available on request. Once enabled, its practices map to the controls you already run for ISO 27001 or SOC 2, so evidence from your code repositories, CI/CD, identity and cloud tools is collected once and counts towards each practice. Our audit team can advise on interpreting tasks for your development process.
Requirements covered
19 practices and 42 tasks in version 1.1, organised into four groups: Prepare the Organisation (PO), Protect the Software (PS), Produce Well-Secured Software (PW) and Respond to Vulnerabilities (RV).
Manual NIST SSDF vs. OneClickComply
- Interpreting 42 outcome-based tasks into concrete controls for your own pipeline
- Gathering screenshots from repositories, build systems and scanners by hand
- Keeping secure development policies in step with how engineers actually work
- Answering customer and federal questionnaires about secure development one by one
- Losing sight of drift in branch protection and access settings between reviews
- Each SSDF practice mapped to the controls you already operate
- Evidence collected automatically from connected development and cloud tools
- Policies generated from your real environment and kept current
- Security questionnaire automation and a trust centre to share your posture
- Continuous monitoring with alerts when development controls drift
Everything you need for NIST SSDF
SSDF practices mapped to your existing ISO 27001 and SOC 2 controls
Automated evidence from code repositories, CI/CD and cloud tools
Access reviews and least-privilege evidence for source code (PS.1)
Secure development and vulnerability disclosure policies generated with AutoComplete
Continuous monitoring of development environment configuration
Risk register and vendor risk management for third-party components
Three steps to NIST SSDF compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST SSDF and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST SSDF-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-218 Secure Software Development Framework (SSDF) requirements
All 19 practices and 42 tasks of SSDF version 1.1 (SP 800-218), with practice titles followed by their tasks; task titles are shortened from the official wording.
| Reference | Requirement |
|---|---|
| PO.1 | Define security requirements for software development |
| PO.1.1 | Document security requirements for development infrastructures and processes |
| PO.1.2 | Document security requirements for organisation-developed software |
| PO.1.3 | Communicate requirements to third-party component suppliers |
| PO.2 | Implement roles and responsibilities |
| PO.2.1 | Create new roles and alter responsibilities for existing roles |
| PO.2.2 | Provide role-based training |
| PO.2.3 | Obtain upper management commitment to secure development |
| PO.3 | Implement supporting toolchains |
| PO.3.1 | Specify the tools or tool types each toolchain must include |
| PO.3.2 | Deploy, operate and maintain tools and toolchains securely |
| PO.3.3 | Configure tools to generate artefacts of secure development practices |
| PO.4 | Define and use criteria for software security checks |
| PO.4.1 | Define criteria for software security checks |
| PO.4.2 | Gather and safeguard information supporting the criteria |
| PO.5 | Implement and maintain secure environments for software development |
| PO.5.1 | Separate and protect each development environment |
| PO.5.2 | Secure and harden development endpoints |
| PS.1 | Protect all forms of code from unauthorised access and tampering |
| PS.1.1 | Store all forms of code based on least privilege |
Always check the official NIST SSDF text for the exact wording.
NIST SSDF FAQs
What is the NIST SSDF?
The NIST SSDF, published as NIST Special Publication 800-218, is the Secure Software Development Framework: a set of high-level practices for reducing vulnerabilities in software. Version 1.1 defines 19 practices and 42 tasks in four groups covering preparing the organisation, protecting the software, producing well-secured software and responding to vulnerabilities. It is outcome-based, so it can be integrated into any software development life cycle or methodology.
Is NIST SSDF compliance mandatory?
No, the SSDF itself is a voluntary framework. Its practical weight came from US federal procurement: OMB memoranda M-22-18 and M-23-16 required agencies to collect secure development attestations based on it. OMB memorandum M-26-05, issued in January 2026, rescinded those memos in favour of agency-level, risk-based assurance, so individual agencies may still ask suppliers for attestations or SBOMs.
Who should follow the NIST SSDF?
Any organisation that produces software can follow the SSDF, from start-ups to large vendors. It matters most to companies selling software to US federal agencies, whose contracts or assurance requests may reference it. Software and SaaS companies elsewhere, including in the UK, also use it as a recognised benchmark to show customers how they build software securely and handle vulnerabilities.
What are the four groups of SSDF practices?
The SSDF organises its practices into four groups. Prepare the Organisation (PO) covers requirements, roles, toolchains and secure environments. Protect the Software (PS) covers protecting code and verifying and archiving releases. Produce Well-Secured Software (PW) covers design, coding, building, review and testing. Respond to Vulnerabilities (RV) covers identifying, remediating and finding root causes of vulnerabilities.
Is there an SSDF certification?
No, NIST does not offer SSDF certification and there is no accredited certification scheme for it. Organisations self-assess against the practices, and some engage third parties to assess them. Under US federal procurement, suppliers have typically demonstrated conformance through self-attestation, such as the CISA Secure Software Development Attestation Form, where an agency asks for one.
How does the SSDF relate to ISO 27001 and SOC 2?
The SSDF goes deeper on secure development than ISO 27001 or SOC 2. ISO 27001 Annex A includes secure development controls such as secure coding and security testing, and SOC 2 covers change management, but the SSDF sets out specific practices for the whole software life cycle. Many controls overlap, so evidence collected for ISO 27001 or SOC 2 often supports SSDF practices too.
What is changing in SSDF version 1.2?
NIST published the initial public draft of SP 800-218 Revision 1, SSDF version 1.2, in December 2025, following Executive Order 14306. The draft adds new and updated practices, tasks and implementation examples, including a new practice in the Prepare the Organisation group. Version 1.1 remains the current final version until NIST publishes the final revision.
Does OneClickComply support the NIST SSDF?
Yes, on request. The NIST SSDF is mapped in OneClickComply's control library and can be enabled for your organisation, rather than being a standard framework available out of the box today. Once enabled, its practices link to your existing controls, so evidence collected for frameworks such as ISO 27001 or SOC 2 also counts towards the SSDF.
Related standards
All standards- NIST Cybersecurity Framework 2.0Framework · US
- NIST Privacy FrameworkFramework · US
- NIST AI Risk Management Framework 1.0Framework · US
- NIST SP 800-37 Rev. 2 (Risk Management Framework)Framework · US
- NIST SP 800-53 Rev. 5Standard · US
- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-53 Rev. 4Standard · US
- NIST SP 800-171A Rev. 3Guidance · US
Get NIST SSDF ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.