NIST SSDF (SP 800-218)

1. PO Prepare the Organization

   Security requirements, roles, toolchains and secure development environments.

2. PS Protect the Software

   Code protection, release integrity and archiving provenance data.

3. PW Produce Well-Secured Software

   Secure design, threat modeling, code review, testing and third-party component reuse.

4. RV Respond to Vulnerabilities

   Vulnerability identification, remediation and root cause analysis.

5. SSDF Project

   SSDF project, mappings and community profile resources.

6. SP 800-218A for AI

   SSDF community profile for generative AI and dual-use foundation models.

7. SP 800-161 Rev 1 C-SCRM

   Cybersecurity supply chain risk management practices.

8. CISA Secure Software Attestation

   Attestation form aligned with SSDF practices.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

• CIS Benchmarks
• CIS Critical Security Controls
• CISA Secure by Design
• CycloneDX
• OpenSSF Scorecard
• SLSA
• SPDX
• Threat Modeling (OWASP and STRIDE)
• Zero Trust (NIST SP 800-207)