NIST Special Publication 800-218

This software development life cycle (SDLC) model explicitly addresses software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well-secured. This document recommends the Secure Software Development Framework (SSDF) – a core set of high-level secure software development practices that can be integrated into each SDLC implementation. Following these practices should help software producers reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences. Because the framework provides a common vocabulary for secure software development, software purchasers and consumers can also use it to foster communications with suppliers in acquisition processes and other management activities.

Modules include:

NIST Special Publication 800-218 Secure Software Development Framework Preamble
NIST Special Publication 800-218 Secure Software Development Framework

What are you waiting for?

NIST 800-218 Designed to Achieve

NIST 800-218 is also known as the Secure Software Development Framework (SSDF).

This framework is used by software developers to create a secure product around guidelines established by the National Institutes of Standards and Technology. The focus is on incorporating robust security practices at every stage of the development life cycle: planning, deployment, and maintenance.

SSDF provides a common set of standards that can be used to reduce security vulnerabilities in software and address the causes of any future gaps. These are applied throughout the development process, including coding, integration testing, reviews, and more.

Benefits of NIST 800-218 compliance

The standards of NIST 800-218 create greatly reduced security vulnerabilities and show a commitment to better risk management when creating quality software. This is a benchmark that applies gold-standard security practices to every step of software development, from the production environment, the acceptance testing phase, automated deployment, and the post-implementation process.

Working within NIST 800-218 compliance requirements makes it simpler to achieve the stringent security demands of government agencies and to work with highly-regulated industries. This alone provides a competitive advantage. Following these security standards also create greater trust among users

FAQ

How does NIST 800-218 relate to the SDLC?

SDLC stands for “Software Development Life Cycle". NIST 800-218 refers to the Secure Software Development Framework and provides a structured path for embedding security protocols at every step of the SDLC. The security standards of NIST 800-218 are included from the very beginning of SDLC, rather than put in as an afterthought.

What will NIST SSDF compliance look like for software vendors?

It begins with management controls that establish clear procedures for secure development, including any training for secure coding. There should be measures created to protect all software components, source code, and to limit access within this controlled environment. Processes for identifying (and remediating) vulnerabilities need to be documented, as well as incident reports.

Who will need to comply first with NIST 800-218?

Any companies that develop and sell software to any part of the U.S. government, whether it’s federal, state, or local, need to be compliant with NIST 800-218. If you’re not currently in compliance, achieving these security standards can offer new opportunities.

What is the difference between ISO 27001 and NIST SP 800?

ISO 27001 is a voluntary international standard for managing information security. It’s a bit more flexible, allowing organizations to adapt to their specific situations. NIST SP 800 compliance is mandatory for all security and privacy controls involving U.S. government information.

What are the phases of the SDLC covered in NIST 800-218?

There aren’t any defined phases in the SDLC regarding NIST 800-218; instead, the process emphasizes a “secure-by-design” approach, implementing security measures from the design stage to implementation, testing, and maintenance. This is a proactive approach that treats security as part of the entire lifecycle, versus as an afterthought.

What are the security controls included in NIST 800-218?

They start by preparing the organization with the policies and procedures for a secure development process. The software must be protected at every stage, and the goal is to produce well-secured software. Finally, a key control is responding to vulnerabilities. Various controls should be implemented against any kind of malicious intervention.

You are just a conversation away from putting the power of Continuum GRC to work for you.

Your Roadmap to Risk Reduction!