thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Secure Software Development Framework (SSDF)

NIST SP 800-218, a set of high-level secure software development practices grouped into Prepare, Protect, Produce and Respond categories.

Definition

The SSDF organizes practices into four groups: Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW) and Respond to Vulnerabilities (RV). It is outcome-based and maps to other models such as BSIMM and SAMM. U.S. federal software suppliers attest to SSDF practices under Executive Order 14028 via the CISA Secure Software Development Attestation Form.

Example

A vendor maps its build-integrity controls to SSDF practice PS.1 (protect all forms of code from unauthorized access and tampering).

Exam tip

Remember the four practice groups PO, PS, PW and RV and the link to Executive Order 14028 attestation.

Related terms