Skip to main content

SP 800-218 (SSDF 1.1)Final2022

Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities

At a glanceA set of secure software development practices for software producers. Districts are buyers, not developers, so its main use is a shared vocabulary for asking edtech and software vendors how they build and patch their products.

Reading level
Technical
Length
36 pages · about 30 min for the key parts
Best for
Technology directors, Business officials
CSF 2.0
Govern
Read it on NIST DOI 10.6028/NIST.SP.800-218 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

Revision in progress. SP 800-218 Rev. 1 (SSDF Version 1.2) initial public draft, 2025-12-17; comments closed 2026-01-30 and no final has been published. SP 800-218A (2024) adds practices for generative AI model development.

Key concepts

The SSDF groups practices into four areas: Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities. Each practice has tasks, examples and references. A draft Version 1.2 (SP 800-218 Rev. 1) was released in December 2025.

How it is organized

  • Prepare the Organization (PO)
  • Protect the Software (PS)
  • Produce Well-Secured Software (PW)
  • Respond to Vulnerabilities (RV)

What a school district should take from it

  • Ask vendors how they handle vulnerability reports and how fast they ship fixes (the RV practices).
  • Ask whether a vendor follows the SSDF and how it can show that.

How to use it in your district

  1. Add three SSDF-based questions to software procurement: secure development practices, vulnerability disclosure, patch timelines.
  2. Prefer vendors with a published vulnerability disclosure policy.
  3. Record vendor answers in the Vendor Registry for renewal reviews.

Common misconceptions

The SSDF is something districts must implement.
It is aimed at software producers; districts use it to ask better questions as buyers.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • GV.SCCybersecurity Supply Chain Risk Management

Tools in the program portal

Related publications

Citation and source

SP 800-218 (SSDF 1.1), Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. National Institute of Standards and Technology. 2022. https://doi.org/10.6028/NIST.SP.800-218.

Replaces: CSWP 13 (SSDF 1.0, 2020).

Topics: Vendors and supply chain, Control catalogs and assessment. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.