How to use this reference
Give each dependency an owner, acceptance requirements, provenance records, and a plan for maintenance or replacement. Revisit these decisions throughout the component’s lifetime. Make the boundary between external supplier evidence and the organization’s own release decision explicit.
Before reading
- Basic dependency management
- Software development lifecycle and release familiarity
Context and limits
- This is a risk-based high-level framework, not a product certification or an exhaustive technical recipe.
- At review, NIST lists SSDF 1.1 as Final and SSDF 1.2 as an Initial Public Draft dated 2025-12-17. The draft’s status and dates must not be merged into this edition’s record.
Sources and provenance
- Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities NIST · reviewed 2026-10-12
- Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities NIST · reviewed 2026-10-12
- Secure Software Development Framework: Publications NIST · reviewed 2026-10-12
- Secure Software Development Framework (SSDF) Version 1.2: Initial Public Draft NIST · reviewed 2026-10-12
Record reviewed 2026-10-12. Snapshot cb017eaea66e. Open the complete JSON contract.