NIST SSDF
NIST SSDF — Secure Software Dev (800-218A). Published by NIST, version SP 800-218A. Kapālins maps it at category level: the assessment’s 3 AI-risk areas, each tied to this framework, rather than clause by clause. 1 of 3 risk areas are proved by a live signal from the platform, and 2 by the assessment.
Live signal: a signal from the gateway, probes or device sensor proves it continuously. Assessment: it is evidenced by answers to the assessment. Both are exported in the regulator evidence pack.
How the NIST SSDF got here.
- Proposed
NIST released the draft of SP 800-218, the Secure Software Development Framework. NIST CSRC
- Adopted
NIST published final SP 800-218, Secure Software Development Framework version 1.1. NIST CSRC
- Proposed
NIST released draft SP 800-218A, an SSDF community profile for generative AI and dual-use foundation models. NIST CSRC
- Guidance
NIST published final SP 800-218A, the SSDF profile for generative AI and dual-use foundation models. NIST CSRC
- Proposed
NIST released the initial public draft of SP 800-218 Revision 1; comments closed 30 January 2026. NIST CSRC