NIST SP 800-218 (SSDF)

PO.1 — Security Requirements Definition

Define security requirements for the software and for supplier/third-party component security — including regulatory, contractual, and organisational requirements.

PO.2 — Roles & Responsibilities

Define security roles within the SDLC — security champions, AppSec engineers, CISO oversight — and train all staff in their secure development responsibilities.

PO.3 — Toolchain Security

Secure the development toolchain — source code repositories, CI/CD pipelines, build systems, and deployment automation — to prevent supply chain attacks on the SDLC.

PS.1 — Software Integrity

Protect all components of the software from tampering — code signing, repository access controls, binary integrity verification, and release artifact signing.

PS.2 — Software Composition Analysis

Use SCA tools to identify, manage, and remediate vulnerabilities in all third-party and open-source components — maintaining a current SBOM.

PW.1 — Design with Security Principles

Incorporate security design principles from the start — threat modelling, least privilege, defence in depth, secure defaults, and fail-safe design.

PW.7 — Code Review

Conduct security-focused code reviews — peer review, automated SAST scanning, and targeted manual review for security-critical components.

RV.1 — Vulnerability Disclosure

Establish and implement a vulnerability disclosure policy and process — enabling external security researchers to report vulnerabilities responsibly.