Framework Structure
NIST Special Publication 800-218 defines the Secure Software Development Framework (SSDF). It defines outcomes to aim for, not tools to run, so it fits Agile, Waterfall, or DevSecOps. 42 tasks are grouped into 19 practices under 4 pillars.
- Prepare the Organization (PO)
- Protect the Software (PS)
- Produce Well-Secured Software (PW)
- Respond to Vulnerabilities (RV)
Each practice has an ID made of its pillar code and a number, such as PO.2. The numbering skips PW.3, which was withdrawn.
| ID | Practice | Section |
|---|---|---|
| PO.1 | Define Security Requirements for Software Development | Define Security Requirements |
| PO.2 | Implement Roles and Responsibilities | Train and Vet Staff |
| PO.3 | Implement Supporting Toolchains | Control the Toolchain |
| PO.4 | Define and Use Criteria for Software Security Checks | Define Security Goals, Enforce a CI/CD Security Gate |
| PO.5 | Implement and Maintain Secure Environments for Software Development | Lock Down the Environment |
| PS.1 | Protect All Forms of Code from Unauthorized Access and Tampering | Protect All Forms of Code |
| PS.2 | Provide a Mechanism for Verifying Software Release Integrity | Verify Integrity on Release |
| PS.3 | Archive and Protect Each Software Release | Archive Each Release, Record Provenance |
| PW.1 | Design Software to Meet Security Requirements and Mitigate Security Risks | Start with Security Requirements |
| PW.2 | Review the Software Design | Start with Security Requirements |
| PW.4 | Reuse Existing, Well-Secured Software | Reuse Well-Secured Components |
| PW.5 | Create Source Code by Adhering to Secure Coding Practices | Follow Secure Coding Practices |
| PW.6 | Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security | Follow Secure Coding Practices |
| PW.7 | Review and/or Analyze Human-Readable Code | Review and Test Code |
| PW.8 | Test Executable Code | Review and Test Code |
| PW.9 | Configure Software to Have Secure Settings by Default | Configure Defaults Securely |
| RV.1 | Identify and Confirm Vulnerabilities on an Ongoing Basis | Identify Vulnerabilities Continuously |
| RV.2 | Assess, Prioritize, and Remediate Vulnerabilities | Assess, Prioritise, and Remediate |
| RV.3 | Analyze Vulnerabilities to Identify Their Root Causes | Analyse Root Cause |
The Measure sections and Run Incident Response are not separate SSDF practices.
