Frameworks · United States
The SSDF asks you to define requirements, protect code, verify releases and review code. CM-3 and CM-5 ask for controlled changes and restricted change access. Aspian Cloud records each as it happens.
- Instrument
- NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1; NIST SP 800-53 Rev. 5 Security and Privacy Controls (current release 5.2.0)
- In force
- SP 800-218 v1.1 final, February 2022. SP 800-218 Rev. 1 (SSDF v1.2) is an initial public draft of 17 Dec 2025 and was still draft when checked. SP 800-53 Rev. 5 Release 5.2.0 issued 27 Aug 2025
- For
- US federal suppliers attesting to secure development, and anyone using NIST as their baseline.
| Clause | What it requires | Evidenced by |
|---|---|---|
| SSDF PO.1 / PO.3 | Define security requirements for software development (PO.1) and put supporting toolchains in place, using automation for repeatable, evidenced security practices (PO.3).Source: csrc.nist.gov | Policy packs versioned like code, applied by the guard in git hooks and agent tool calls. |
| SSDF PS.1 / PS.2 / PS.3 | Protect all code from unauthorised access and tampering, give acquirers a way to verify release integrity, and archive and protect each release.Source: csrc.nist.gov | Repository baselines, build provenance checked against an exact signer identity, and signed releases. |
| SSDF PW.7 / RV.1 | Review or analyse human-readable code for vulnerabilities and requirement compliance (PW.7), and identify and confirm vulnerabilities on an ongoing basis (RV.1).Source: csrc.nist.gov | Review rules: an author never approves their own change, and an automated review never replaces a human one. |
| SP 800-53 CM-3 / CM-5 | Configuration change control: changes are reviewed, approved or rejected, documented, implemented and retained (CM-3). Access to make changes is restricted and enforced (CM-5).Source: csf.tools | Change records for CM-3; just-in-time production access tied to an approved change for CM-5. |
Clause references and requirements were read on 8 November 2026 from the official text. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.