Secure Software Development Framework SSDF

References

The SSDF uses these established secure development practice documents as references. Note that these references were current at the time SSDF version 1.1 was published, and may no longer be current.

NIST Publications

General

• Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1
• National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (SP 800-181)
• Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5)

Software Development

• Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (2nd Draft) (SP 800-161 Rev. 1)
• Guidelines on Minimum Standards for Developer Verification of Software (IR 8397)
• Recommendations for Federal Vulnerability Disclosure Guidelines (Draft) (SP 800-216)
• Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems (SP 800-160 Vol. 1)

Government, Industry, and Academic Publications

International Standards

• International Electrotechnical Commission (IEC), Security for industrial automation and control systems – Part 4-1: Secure product development lifecycle requirements, IEC 62443-4-1
• International Organization for Standardization (ISO)/IEC, Information technology – Security techniques – Application security – Part 1: Overview and concepts, ISO/IEC 27034-1:2011
• ISO/IEC, Information technology – Security techniques – Vulnerability handling processes, ISO/IEC 30111:2019

Open Web Application Security Project (OWASP)

• OWASP Application Security Verification Standard 4.0.3
• OWASP Mobile Application Security Verification Standard, Version 1.4
• OWASP Software Component Verification Standard, Version 1.0
• Software Assurance Maturity Model Version 1.5

Software Assurance Forum for Excellence in Code (SAFECode)

• Fundamental Practices for Secure Software Development: Essential Elements of a Secure Development Lifecycle Program, Third Edition
• Managing Security Risks Inherent in the Use of Third-Party Components
• Practical Security Stories and Security Tasks for Agile Development Environments
• Software Integrity Controls: An Assurance-Based Approach to Minimizing Risks in the Software Supply Chain
• Tactical Threat Modeling

Additional Guidance and Recommended Practice Publications

• BSA, The BSA Framework for Secure Software: A New Approach to Securing the Software Lifecycle, Version 1.1
• Building Security in Maturity Model Version 12 (BSIMM12) 2021 Foundations Report
• Cloud Native Computing Foundation, Software Supply Chain Best Practices
• Institute for Defense Analyses (IDA), State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation 2016
• Microsoft, Security Development Lifecycle
• National Telecommunications and Information Administration (NTIA), The Minimum Elements For a Software Bill of Materials (SBOM)
• Payment Card Industry (PCI) Security Standards Council, Secure Software Lifecycle (Secure SLC) Requirements and Assessment Procedures Version 1.1 [Note: For more information on the relationship between the PCI SSC work and the NIST SSDF, see the PCI blog post "NIST and PCI SSC Find Common Ground in Development of Software Frameworks"]