NIST SSDF

Overview

The NIST Secure Software Development Framework (SSDF) is a set of fundamental, sound practices for secure software development published by the National Institute of Standards and Technology (SP 800-218). It defines four practice groups: Prepare the Organization, Protect the Software, Produce Well-Secured Software, and Respond to Vulnerabilities. CodeMiners aligns its development practices with the NIST SSDF to meet US federal government software security requirements and industry best practices.

Governing Body

National Institute of Standards and Technology (NIST), US Department of Commerce

Scope of Certification

Covers four practice groups: Prepare the Organization (define security requirements, implement toolchains), Protect the Software (secure code repositories, verify integrity), Produce Well-Secured Software (design, code, test securely), and Respond to Vulnerabilities (identify, remediate, disclose).

Audit and Assessment Process

NIST SSDF is a framework, not a certifiable standard. Alignment is demonstrated through documentation of practices, tool configurations, and evidence of implementation. Federal agencies may require self-attestation under Executive Order 14028.

Key Requirements

1. Secure development environment configuration
2. Source code and build integrity verification
3. Automated security testing in CI/CD pipelines
4. Software Bill of Materials (SBOM) generation
5. Vulnerability disclosure and response procedures
6. Third-party component security verification

Compliance Entitlements

• Alignment with NIST SP 800-218 secure development practices
• Coverage of all four SSDF practice groups
• Required for US federal government software supply chain compliance
• Structured approach to vulnerability management and incident response

Client Benefits

• Meets US federal government software security requirements (EO 14028)
• Demonstrates alignment with the most comprehensive secure development framework available
• Provides SBOM-backed transparency into software composition

Related Certifications