MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesSoftware LifecycleSSDF

    Secure Software Development Framework

    NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

    Definition

    NIST SP 800-218 SSDF v1.1 organizes secure-development practices into Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities. NIST also published SP 800-218 Rev. 1, SSDF v1.2, as an initial public draft on December 17, 2025; do not describe that draft as final.
    What the regulation says
    FDA recommends an SPDF as one approach in its February 2026 guidance; SSDF use is not itself an FDA legal requirement or blanket acceptance of a submission. Federal assurance requests now depend on applicable agency policy and contracts following OMB M-26-05.

    What this means in practice

    SSDF is a secure-development framework that can support supplier assurance. OMB M-26-05, issued January 23, 2026, rescinded M-22-18 and M-23-16 and adopted agency risk-based software and hardware assurance. Agencies may still request attestations or contract-specific evidence. Do not describe SSDF as a proven superset of IEC 81001-5-1 without a clause-level comparison.

    Examples

    • Illustrative: A MedTech manufacturer uses the SSDF framework to structure its internal secure development lifecycle processes, ensuring that cybersecurity is integrated from initial design through to post-market surveillance.
    • Illustrative: During a pre-market submission to the FDA for a new medical device, the manufacturer provides documentation demonstrating how its software development practices align with the four practice groups of SSDF.
    • Illustrative: To comply with federal procurement requirements, a software vendor seeking to sell its health IT solution to a government agency attests that its development processes adhere to SSDF guidelines.
    Common pitfalls
    • •Adopting SSDF in name only, the framework expects measurable practices with evidence (e.g., PW.4 'Reuse Existing, Well-Secured Software When Feasible' requires component selection criteria and provenance records).
    • •Conflating SSDF with SPDF, SPDF is FDA's umbrella term; SSDF is one specific framework that can satisfy an SPDF requirement.
    • •Forgetting RV (Respond to Vulnerabilities), many manufacturers' SSDF programs are strong on development but weak on post-market response.

    Frequently asked questions

    SSDF, published as NIST SP 800-218, organizes practices into Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV), with each practice broken into specific tasks, implementation examples, and references to related standards such as OWASP SAMM, BSIMM, ISO/IEC 27034, and IEC 62443.

    Related terms

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Sources

    6 sources

    Sources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Official-source claim check:

    NIST SSDF provides secure-development practices in four groups. Federal attestation policy changed in January 2026.

    Partial review: verified corrections are applied, but this is not a full accuracy certification. The last full review date is unchanged.

    Remaining verification limits
    • Secondary regulatory, standards-clause, market-prevalence or procurement claims were not fully substantiated by accessible original text.
    Tier 2Regulator guidance and consensus· 5Tier 4Trade press and expert commentary· 1
    Link health: 3 verified 3 unchecked· last checked 2026-06-20
    NIST·2HSCC·1CISA·1OMB·1FDA·1
    1. 1
      NIST SP 800-218: SSDF v1.1
      Tier 2 Verified
      NISTcsrc.nist.gov
    2. 2
      HSCC - Health Sector Coordinating Council
      Tier 4 Verified
      HSCChealthsectorcouncil.org
    3. 3
      CISA - Healthcare and Public Health Sector
      Tier 2 Verified
      CISAcisa.gov
    4. 4
      NIST SSDF 1.2 initial draft
      Tier 2 Unchecked
      NISTcsrc.nist.gov
    5. 5
      OMB M-26-05
      Tier 2 Unchecked
      OMBwhitehouse.gov
    6. 6
      FDA final guidance, February 3, 2026
      Tier 2 Unchecked
      FDAfda.gov

    Inline markers like [1] jump to the matching reference above.