Skip to content

feat: add NIST SP 800-218 Secure Software Development Framework skill#43

Open
sjackson0109 wants to merge 1 commit intoSushegaad:mainfrom
sjackson0109:feature/nist-sp-800-218-skill
Open

feat: add NIST SP 800-218 Secure Software Development Framework skill#43
sjackson0109 wants to merge 1 commit intoSushegaad:mainfrom
sjackson0109:feature/nist-sp-800-218-skill

Conversation

@sjackson0109
Copy link
Copy Markdown

@sjackson0109 sjackson0109 commented Apr 16, 2026

NIST SP 800-218 — Secure Software Development Framework (SSDF)

Source: NIST Special Publication 800-218, Version 1.1, February 2022
CSRC: https://csrc.nist.gov/publications/detail/sp/800-218/final

Files Added

plugins/nist-sp-800-218/
  .claude-plugin/
    plugin.json
  skills/
    nist-sp-800-218/
      SKILL.md
      references/
        ssdf-practices.md
        secure-development-controls.md
        implementation-guidance.md

Framework Coverage

  1. SSDF purpose and scope: reduce software vulnerabilities, address root causes, support repeatable measurement; applies to all software types (COTS, open source, custom-developed, SaaS)
  2. Four practice groups: PO (Prepare the Organisation, 5 practices), PS (Protect the Software, 3 practices), PW (Produce Well-Secured Software, 7 active practices), RV (Respond to Vulnerabilities, 3 practices); 19 active practices total (PW.3 and PW.8 removed in SSDF v1.1)
  3. PO.1 Security Requirements: organisational and project-level requirements; OWASP ASVS risk tiers; threat modelling as requirements derivation method; CWE Top 25 as reference
  4. PO.2 Roles and Responsibilities: role definitions with security responsibilities; training curriculum by role; security champions programme establishment
  5. PO.3 Supporting Toolchains: toolchain coverage by SDLC phase; CI/CD pipeline gate configuration with thresholds and blocking conditions; approved tool catalogue
  6. PO.4 Security Check Criteria: SDLC phase-gate checklists for 5 phase transitions; severity-to-gate-impact mapping; exception and risk acceptance process
  7. PO.5 Secure Environments: dev/staging/production separation; developer workstation security baseline; build environment hardening (ephemeral agents, OIDC authentication, secrets manager integration)
  8. PS.1 Protect Code: repository RBAC; branch protection rules; CODEOWNERS; secrets scanning (pre-commit + CI); secrets incident response (key rotation, history purging)
  9. PS.2 Integrity Verification: code signing (Authenticode, Apple Developer ID, GPG, cosign); SHA-256/384/512 checksums; HSM/KMS key storage; SLSA framework levels with provenance attestation JSON
  10. PS.3 Archive Releases: per-release security package structure (artifacts, SBOM, scan reports, provenance, approvals); immutable storage; retention requirements
  11. PW.1 Secure Design: 5-step threat modelling process with STRIDE applied to DFD elements; DREAD/CVSS threat rating; mitigation disposition; secure design principles catalogue
  12. PW.2 Design Review: architecture review board gate; design review checklist; risk register for design-level findings
  13. PW.4 Component Reuse: component health evaluation criteria table with reject/warn/accept thresholds; OpenSSF Scorecard check inventory with SSDF alignment; dependency version pinning strategy
  14. PW.5 Secure Coding: language-specific secure coding standards and primary CWEs for 8 languages (C/C++, Java, Python, JavaScript/TypeScript, Go, .NET/C#, Ruby, PHP); 7 universal secure coding principles
  15. PW.6 Build Hardening: C/C++ compiler security flags; ASLR/PIE; Control Flow Integrity; JVM security; container image hardening (non-root, read-only rootfs, capability dropping)
  16. PW.7 Code Review: mandatory security-focused review scope; SAST finding priority mapping by severity; automated code review integration in PR workflow
  17. PW.9 Security Testing: test type catalogue (SAST, SCA, secrets, DAST, API, container, IaC, fuzz, penetration test, licence); penetration test scope document template; DAST CI integration
  18. RV.1 Identify Vulnerabilities: internal and external sources; NVD/CISA KEV/OSV/GitHub Advisory monitoring; VDP template; responsible disclosure process
  19. RV.2 Assess and Remediate: CVSS v3.1 base and environmental scoring; remediation SLA by severity (Critical 15 days, High 30 days, Medium 90 days, Low 180 days); patch delivery decision tree; CVD process
  20. RV.3 Root Cause Analysis: root cause taxonomy table; RCA record template; training improvement loop; quarterly trend reporting
  21. EO 14028 software security requirements table with SSDF practice mapping; OMB M-22-18 and M-23-16 compliance requirements; software attestation form template
  22. SBOM: NTIA 7 minimum elements; SPDX, CycloneDX, and SWID formats; SBOM quality dimensions; SBOM-based CVE monitoring workflow
  23. Complete SP 800-53 Rev 5 mapping for all 18+ practices across SA, AT, CM, RA, CA, SI, PL, PM, IR control families
  24. NIST CSF 2.0 function and category mapping across GV, ID, PR, DE, RS, RC functions
  25. ISO 27001:2022 control mapping covering domains 8.25-8.31 and 8.8 plus supporting controls
  26. SSDF maturity model (levels 0-4); maturity assessment grid; three-phase roadmap (Foundation 1-3 months, Depth 3-9 months, Optimise 9-18 months)
  27. Application risk classification: 4-tier model with scoring criteria
  28. SSDF for AI/ML software aligned to NIST SP 800-218A draft supplement
  29. Vendor/third-party SSDF requirements: procurement checklist; 6 model contractual clauses

Reference Files

ssdf-practices.md

  • Complete task-level inventory of all 19 SSDF practices with task IDs and implementation examples
  • Security champion programme structure and training curriculum table
  • CI/CD pipeline gate configuration with explicit threshold and blocking logic
  • SDLC phase-gate checklist (5 gates: requirements → design, design → code, code → test, test → RC, RC → production)
  • Developer workstation security baseline table
  • Repository branch protection configuration baseline
  • Secrets detection patterns and response procedure
  • SLSA provenance attestation JSON example
  • Per-release security package directory layout
  • Threat modelling process with STRIDE element-by-element application
  • Component health evaluation criteria with OpenSSF Scorecard check descriptions
  • Language-specific secure coding standards table (8 languages, primary CWEs)
  • Security testing type catalogue with test purpose, trigger timing, and tool examples
  • Penetration test scope document template
  • Root cause taxonomy table by CWE, SDLC phase, and failure type
  • Root cause analysis record template
  • VDP template and CVE monitoring frequency table

secure-development-controls.md

  • Annotated DevSecOps pipeline architecture (pre-commit through production monitoring)
  • SAST: Semgrep ruleset catalogue; SARIF integration; CodeQL query inventory mapped to CWE and SSDF
  • SCA: scanning scope definition; dependency version pinning comparison table; OWASP Dependency-Check CI configuration YAML
  • Secrets management: secret type and detection pattern table; OIDC-based pipeline authentication description; supported OIDC integrations by platform
  • Container security: image build control table; cosign/Sigstore signing and verification commands; keyless signing explanation
  • SBOM: Syft generation commands; SBOM quality dimensions table; SBOM-based CVE monitoring workflow
  • EO 14028 / OMB M-22-18 attestation requirements and form language
  • DevSecOps security metrics (10 metrics with targets)
  • OWASP CI/CD Security Top 10 full mapping to SSDF practices

implementation-guidance.md

  • SSDF maturity assessment scale (0–4) and complete practice maturity grid
  • Three-phase roadmap with activities, milestones, and success criteria
  • Application risk classification (4 tiers, 5-criterion scoring table)
  • SSDF compliance evidence requirements per practice
  • Federal attestation package requirements and attestation form template
  • SSDF to ISO 27001:2022 full mapping table
  • SSDF to SP 800-53 Rev 5 control family mapping by practice group
  • SSDF to NIST CSF 2.0 mapping
  • SSDF for AI/ML software (SP 800-218A alignment)
  • Third-party procurement checklist (10 items)
  • 6 model contractual SSDF clauses

Integration Points

  • SP 800-53 Rev 5: SSDF directly implements SA (Software Acquisition), AT (Training), CM (Configuration Management), RA (Risk Assessment), SI (Flaw Remediation), IR control requirements
  • SP 800-37 Rev 2 RMF: SSDF practices feed RMF steps 1 (categorise), 2 (select), 3 (implement)
  • SP 800-161 Rev 1 C-SCRM: PS practices and PW.4 support supply chain risk management; SBOM requirements align to C-SCRM supplier obligations
  • NIST CSF 2.0: SSDF practices map to all six CSF functions (GV, ID, PR, DE, RS, RC)
  • ISO 27001:2022: SSDF satisfies Annex A controls 8.25-8.31 (secure development) and 8.8 (vulnerability management)
  • EO 14028: SSDF is the designated NIST framework for EO 14028 software supply chain security; OMB M-22-18/M-23-16 require SSDF attestation for federal software procurement
  • CISA KEV: RV.1/RV.2 monitoring must include daily CISA KEV feed matching against deployed software component inventory

Tests

python -m pytest tests/test_plugin_structure.py -v -k "nist-sp-800-218"

test_plugin_json_exists[nist-sp-800-218] PASSED
test_plugin_json_is_valid[nist-sp-800-218] PASSED
test_plugin_json_required_fields[nist-sp-800-218] PASSED
test_plugin_version_semver[nist-sp-800-218] PASSED
test_skills_directory_exists[nist-sp-800-218] PASSED
test_skills_directory_has_one_skill_folder[nist-sp-800-218] PASSED
test_skill_md_exists[nist-sp-800-218] PASSED
test_skill_md_not_empty[nist-sp-800-218] PASSED
test_no_files_outside_skill_folder[nist-sp-800-218] PASSED
test_references_are_markdown[nist-sp-800-218] PASSED

10 passed, 95 deselected

@sjackson0109
feat: add NIST SP 800-218 Secure Software Development Framework skill
aa181e9 
PLUGIN: nist-sp-800-218
VERSION: 1.0.0
SOURCE: NIST Special Publication 800-218, Version 1.1, February 2022
TITLE: Secure Software Development Framework (SSDF)
CSRC: https://csrc.nist.gov/publications/detail/sp/800-218/final

PLUGIN STRUCTURE:
  plugins/nist-sp-800-218/.claude-plugin/plugin.json
  plugins/nist-sp-800-218/skills/nist-sp-800-218/SKILL.md
  plugins/nist-sp-800-218/skills/nist-sp-800-218/references/ssdf-practices.md
  plugins/nist-sp-800-218/skills/nist-sp-800-218/references/secure-development-controls.md
  plugins/nist-sp-800-218/skills/nist-sp-800-218/references/implementation-guidance.md

FRAMEWORK COVERAGE:
  1. SSDF purpose and scope: reduce software vulnerabilities, address root causes, enable repeatable measurement; applies to all software types (COTS, OSS, custom, SaaS)
  2. Four practice groups: PO (Prepare the Organisation, 5 practices), PS (Protect the Software, 3 practices), PW (Produce Well-Secured Software, 8 active practices), RV (Respond to Vulnerabilities, 3 practices); 19 active practices total
  3. PO.1 Security Requirements: organisational-level and project-level security requirements; OWASP ASVS levels; threat modelling as requirements derivation; CWE Top 25 as reference
  4. PO.2 Roles and Responsibilities: security responsibilities in job descriptions; role-specific training curriculum; security champions programme establishment
  5. PO.3 Supporting Toolchains: SDLC toolchain coverage by phase (pre-commit, CI build, pre-release, release, production monitoring); pipeline gate configuration with thresholds
  6. PO.4 Security Check Criteria: SDLC phase-gate checklists; severity-to-gate-impact mapping; exception process with compensating controls and risk acceptance
  7. PO.5 Secure Environments: environment separation (dev/staging/production); developer workstation security baseline; build environment security (ephemeral agents, OIDC, secrets manager)
  8. PS.1 Protect Code: version control with RBAC; branch protection rules; CODEOWNERS; secrets scanning and response procedure; audit logging
  9. PS.2 Integrity Verification: code signing (Authenticode, Apple, GPG, cosign); SHA-256 checksums; HSM/KMS for signing keys; SLSA framework levels 1-4; SLSA provenance JSON structure
  10. PS.3 Archive Releases: per-release security package contents (artifacts, SBOM, security scans, provenance, approvals); immutable storage; retention requirements
  11. PW.1 Secure Design: threat modelling 5-step process (scope, STRIDE threat identification, DREAD evaluation, mitigation determination, validation); STRIDE element-by-element application; secure design principles
  12. PW.2 Design Review: architecture review board; design review checklist; design-level risk register
  13. PW.4 Component Reuse: component health evaluation criteria (maintenance, CVEs, licence, Scorecard); OpenSSF Scorecard check descriptions and SSDF mapping; dependency version pinning strategy
  14. PW.5 Secure Coding: language-specific standards (C/C++/Java/Python/JavaScript/Go/.NET/Ruby/PHP) with key CWEs; universal secure coding principles (input validation, output encoding, authentication, cryptography, error handling, logging)
  15. PW.6 Build Hardening: C/C++ compiler flags (stack protector, FORTIFY, PIE, RELRO); ASLR; CFI; JVM security; container image hardening (non-root, read-only rootfs, drop capabilities)
  16. PW.7 Code Review: mandatory security review for auth/crypto/session/input handling code; SAST finding priority mapping; automated code review in PR workflow
  17. PW.9 Security Testing: test type catalogue (SAST, SCA, secrets, DAST baseline, DAST full, API security, container, IaC, fuzz, pentest, licence); sample pen test scope document template; DAST CI integration
  18. RV.1 Identify Vulnerabilities: internal and external vulnerability sources; NVD/CISA KEV/OSV monitoring; vulnerability disclosure policy (VDP) template; responsible disclosure process
  19. RV.2 Assess and Remediate: CVSS v3.1 environmental scoring adjustments; remediation SLA table by severity; patch delivery decision tree; coordinated vulnerability disclosure (CVD) process
  20. RV.3 Root Cause Analysis: root cause taxonomy by CWE, SDLC phase, failure type; RCA record template; quarterly trend reporting; training improvement loop
  21. EO 14028 software security requirements table with SSDF practice mapping; OMB M-22-18 and M-23-16 operationalisation; software attestation requirements for federal software producers
  22. SBOM: NTIA 7 minimum elements; SPDX, CycloneDX, and SWID formats; SBOM delivery requirements; SBOM quality dimensions (completeness, identifiability, accuracy, freshness, integrity)
  23. SP 800-53 Rev 5 complete mapping of all 18 practices to SA, AT, CM, RA, CA, SI, PL, IR control families
  24. NIST CSF 2.0 mapping across Govern, Identify, Protect, Detect, Respond, Recover functions
  25. ISO 27001:2022 mapping covering 8.26, 8.28, 8.29, 8.25, 8.27, 8.31, 8.4, 5.33, 5.7, 8.8 controls
  26. SSDF maturity model (levels 0-4); maturity assessment grid for all 18+ practices; three-phase implementation roadmap (Foundation 1-3mo, Depth 3-9mo, Optimise 9-18mo)
  27. Application risk classification: 4 tiers with scoring criteria table; per-tier SSDF rigour requirements
  28. SSDF compliance evidence requirements: required evidence per practice; attestation package for federal software producers; self-attestation form language
  29. NIST SP 800-218A alignment for AI/ML software: additional PO/PS/PW/RV considerations for ML training data, model artifacts, adversarial threats, model versioning
  30. Vendor and third-party SSDF requirements: procurement checklist; 6 contractual SSDF requirement clauses (attestation, SBOM delivery, vulnerability notification, remediation SLA, EOL restriction, artifact integrity)

REFERENCE FILES:
  ssdf-practices.md:
    - Complete SSDF practice inventory: all 4 groups, all 19 active practices
    - Per-practice task table with task IDs and implementation examples
    - Security champion programme definition and training curriculum table
    - Complete CI/CD pipeline gate configuration example with thresholds and actions
    - SDLC security phase-gate checklist for all 5 phase transitions
    - Developer workstation security baseline table
    - Repository branch protection configuration baseline
    - Secrets response procedure (rotation and history purging)
    - SLSA provenance attestation JSON example
    - Per-release security package directory structure
    - Threat modelling 5-step procedure with STRIDE application
    - Component health evaluation criteria table with accept/warn/reject thresholds
    - OpenSSF Scorecard check inventory with SSDF mappings
    - Language-specific secure coding standards and CWE risks table (8 languages)
    - Universal secure coding principles (7 principles)
    - Security testing approach by test type table
    - Penetration test scope document template
    - Root cause taxonomy table by CWE and SDLC phase
    - Root cause analysis record template
    - Vulnerability disclosure policy template
    - External vulnerability source monitoring table with frequencies
    - CVSS-based vulnerability remediation SLA table
    - CVSS environmental scoring adjustment guidance
    - Patch delivery decision tree
  secure-development-controls.md:
    - DevSecOps pipeline architecture: full annotated pipeline stages (pre-commit through production monitoring)
    - SAST: Semgrep ruleset table; SARIF integration; CodeQL query table with CWEs
    - SCA: scanning scope definition; dependency version pinning strategy table; OWASP Dependency-Check CI integration YAML
    - Secrets management: secret type and detection pattern table; OIDC-based pipeline authentication pattern; supported OIDC integrations
    - Container security: image build security control table; cosign/Sigstore signing and verification commands; Sigstore keyless signing explanation
    - SBOM: Syft generation commands; SBOM quality dimension table; SBOM-based CVE monitoring workflow
    - EO 14028 / OMB M-22-18 attestation requirements; attestation form template language
    - DevSecOps security metrics table (10 metrics with targets and measurement sources)
    - OWASP CI/CD Security Top 10 mapping to SSDF practices
  implementation-guidance.md:
    - SSDF implementation approach (5 steps)
    - Maturity assessment scale (levels 0-4) and practice maturity assessment grid
    - Three-phase implementation roadmap with milestones, activities, and success criteria per phase
    - Application risk classification: 4 tiers with scoring criteria; risk scoring table (5 characteristics, 0-2 scale)
    - SSDF compliance evidence requirements table by practice
    - Federal software producer attestation package requirements; attestation form template
    - SSDF to ISO 27001:2022 complete mapping (18 practice rows)
    - SSDF to SP 800-53 Rev 5 control family mapping by practice group
    - SSDF to NIST CSF 2.0 function and category mapping
    - SSDF for AI/ML software per practice group (aligned to SP 800-218A draft)
    - Third-party software procurement checklist (10 items)
    - 6 model contractual SSDF requirement clauses

INTEGRATION POINTS:
  - SP 800-53 Rev 5: SSDF practices implement SA (System and Services Acquisition), AT, CM, RA, CA, SI, IR control requirements
  - SP 800-37 Rev 2 RMF: SSDF practices feed into RMF steps 1 (categorise), 2 (select controls), 3 (implement)
  - SP 800-161 Rev 1 (C-SCRM): SSDF PS practices and PW.4 directly support supply chain risk management; PS.2/PS.3 SBOM requirements align to C-SCRM supplier requirements
  - NIST CSF 2.0: SSDF practices map to GV, ID, PR, DE, RS, RC functions
  - ISO 27001:2022: SSDF practices directly satisfy controls in domains 8.25-8.31 (Software Development) and 8.8 (Technical Vulnerability Management)
  - EO 14028: SSDF is designated by NIST as the primary framework for satisfying EO 14028 software supply chain security requirements
  - CISA KEV (Known Exploited Vulnerabilities): RV.1/RV.2 continuous monitoring must include CISA KEV feed matching against software component inventory
  - SP 800-218A (draft): extends SSDF for AI/ML software; additional PO/PS/PW/RV tasks for training data, model artifacts, adversarial threats

TESTS:
  test_plugin_json_exists[nist-sp-800-218] PASSED
  test_plugin_json_is_valid[nist-sp-800-218] PASSED
  test_plugin_json_required_fields[nist-sp-800-218] PASSED
  test_plugin_version_semver[nist-sp-800-218] PASSED
  test_skills_directory_exists[nist-sp-800-218] PASSED
  test_skills_directory_has_one_skill_folder[nist-sp-800-218] PASSED
  test_skill_md_exists[nist-sp-800-218] PASSED
  test_skill_md_not_empty[nist-sp-800-218] PASSED
  test_no_files_outside_skill_folder[nist-sp-800-218] PASSED
  test_references_are_markdown[nist-sp-800-218] PASSED
  10 passed, 95 deselected
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sjackson0109