What category of practice vocabulary this is
NIST SP 800-218 is the subject. The official title is Secure Software Development Framework (SSDF) Version 1.1. NIST SSDF Version 1.1 is a software security development framework. It is also a shared vocabulary for practices across the software lifecycle. Producers and acquirers can use the same terms. SSDF names practices, not products to install, SBOM files, or certificates.
A common misread treats an SBOM or an Executive Order checkbox as SSDF complete. Another misread folds SSDF into AI RMF or an OWASP awareness list. SSDF is a practice vocabulary. No law requires an SSDF certificate, and no scheme issues one.
Edition covered
The edition string is NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1, final, February 2022 (document history 3 February 2022). The DOI is 10.6028/NIST.SP.800-218. Official hubs are https://csrc.nist.gov/pubs/sp/800/218/final and https://doi.org/10.6028/NIST.SP.800-218. On 2026-09-26, the publication page still stated Date Published February 2022 and Document History 02/03/22 Final. It still listed the same DOI.
SP 800-218 Revision 1 (SSDF Version 1.2) remains an initial public draft. Date Published December 17, 2025 (17 December 2025). The public comment period closed on January 30, 2026 (30 January 2026). Version 1.2 is not final. The draft hub is https://csrc.nist.gov/pubs/sp/800/218/r1/ipd.
PO, PS, PW, and RV are literacy terms
Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV) are the four practice groups. PO covers who owns the secure environment around the pipeline and the practice conversation. PS covers how a team protects code and release integrity. Inventory evidence can sit in that conversation. An SBOM is not SSDF done. PW covers how software is designed, reviewed, and tested with security in mind. RV covers what happens when a vulnerability shows up, with an owner and a review date.
These are group terms. They are not a finished implementation. Task identifiers stay in the NIST publication.
The practice conversation first, then the evidence
The habit covers four points: the practice conversation that is needed, the evidence that can be credible, the owner of the decision, and the work that remains outside SSDF. A named owner for one specific practice is a start. A slide that states SSDF certified is not that evidence.
SP 800-218A is a companion, not this edition
SP 800-218A is a companion publication. Its official title is Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile. Its Final date is 26 July 2024 (document history 07/26/24). Date Published July 2024. Its DOI is 10.6028/NIST.SP.800-218A. It does not go into the Version 1.1 edition string.
Rewrite the one-line claim
The claim "we are SSDF certified" has no certificate behind it. Exact replacement: "We use NIST SSDF Version 1.1 as a shared software security practice vocabulary, then cite the evidence and decision owner for the specific practice."
A slide can state "SSDF certified" or "SSDF complete." The team then checks the edition (SP 800-218, Version 1.1, February 2022) and the live need. The live need can be SSDF vocabulary, an SBOM inventory, AI RMF placement, web Top 10 awareness, LLM awareness, or ASVS verification depth.
Common folds next to this vocabulary
| Phrase people use | Literacy correction |
|---|---|
| Our SBOM means SSDF is done. | An SBOM is one possible artifact or inventory evidence. One artifact does not show that every practice is in place. Lesson: /learn/topics/sbom-evidence-and-priority/. SBOM lab: /labs/sbom-decision/. |
| The Executive Order checkbox proves SSDF certification. | A policy or procurement requirement is not a certificate. It does not turn SSDF into a certification scheme. The actual requirement and the evidence owner must be verified. Field guide: /reference/frameworks/nist-sp-800-218/. |
| SSDF is AI RMF. | SSDF is a secure software development practice vocabulary. NIST AI RMF 1.0 is a separate voluntary AI risk framework. Explainer: /learn/explainers/nist-ai-rmf/. |
| SSDF is the OWASP web or LLM Top 10. | OWASP Top 10:2025 and GenAI LLM Top 10:2026 are separate awareness lists. SSDF is not either list. Web Top 10: /learn/explainers/owasp-top-10/. LLM Top 10: /learn/explainers/owasp-llm-top-10/. ASVS for verification depth: /learn/explainers/owasp-asvs/. |
| We listed the practices, so the product is secure. | A mention of a framework is not evidence of implementation, assessment, certification, or absence of risk. A3: /learn/topics/pipeline-write-vs-promote/. AppSec path: /learn/paths/appsec-supply-chain/. Landscape: /landscape/segments/application-security/. |
| SSDF Version 1.2 is final. | Official NIST status at this review still lists Revision 1 / Version 1.2 as an initial public draft. That draft is dated 17 December 2025 (December 17, 2025). Public comment closed 30 January 2026. Version 1.2 is not final. |
Common misconceptions
An SBOM means SSDF is done.
SSDF covers four practice groups. An SBOM is inventory evidence for one part of that work.
The Executive Order checkbox proves SSDF certification.
A procurement requirement can ask for SSDF practices. The requirement does not create a certificate.
SSDF is AI RMF.
SSDF covers secure software development practice. AI RMF 1.0 organizes AI risk work in four functions.
SSDF and the OWASP Top 10 lists are the same kind of document.
SSDF names development practices. The OWASP lists name risk themes for awareness.
A list of the practices means the product is secure.
A practice name on a slide shows no implementation. Evidence and a decision owner are still needed.
SSDF Version 1.2 is final.
Revision 1 / Version 1.2 remains an initial public draft dated 17 December 2025. Version 1.2 is not final.
SP 800-218A is the Version 1.1 edition pin.
SP 800-218A is a GenAI SSDF community profile companion (final 26 July 2024). The Version 1.1 pin stays SP 800-218.
PO, PS, PW, RV, as terms
The practice and task catalog stays in the NIST publication.
| Group | One-line literacy |
|---|---|
| Prepare the Organization (PO) | Who owns the secure environment around the pipeline and the practice conversation |
| Protect the Software (PS) | Protection of code and release integrity. Inventory evidence can sit here. An SBOM is not SSDF done |
| Produce Well-Secured Software (PW) | How software is designed, reviewed, and tested with security in mind |
| Respond to Vulnerabilities (RV) | What happens when a vulnerability shows up, with an owner and a review date |
CHECK THE CATEGORY
Which sentence matches NIST SSDF Version 1.1?
Glossary and nearby pages
- NIST SSDF Version 1.1 field guide (edition pin companion)
- Who can write, who can promote (A3)
- An SBOM is inventory, not a control (A4)
- Lab: Defer with a date, or patch for a reason
- Application and software supply-chain path
- Landscape: Application and software supply chain
- NIST AI RMF 1.0 explainer (voluntary AI framework, not this vocabulary)
- NIST SP 800-207 ZTA explainer (architecture paradigm, not this vocabulary)
- OWASP LLM Top 10 explainer (awareness list, not this vocabulary)
- OWASP Top 10 explainer (web awareness list, not this vocabulary)
- OWASP ASVS explainer (verification requirements, not this vocabulary)
- Compare the six maps (a row is not this vocabulary, and not a seventh map)
- Outcomes first, then controls (F8a)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.