Is SSDF conformance legally required for medical device manufacturers?

SSDF attestation became mandatory for software sold to the U.S. federal government under Executive Order 14028 and OMB Memorandum M-22-18, but it is not itself an FDA legal requirement for medical devices. However, FDA's Cybersecurity in Medical Devices guidance recommends a Secure Product Development Framework and explicitly accepts SSDF as one acceptable framework for demonstrating that expectation in a premarket submission.

How does SSDF relate to IEC 81001-5-1 for device manufacturers?

SSDF practices are largely a superset of IEC 81001-5-1 Section 5's secure development lifecycle requirements, so citing both in a premarket cybersecurity submission demonstrates the breadth of SSDF alongside the medical-device-specific depth of IEC 81001-5-1, and many manufacturers structure internal secure development procedures to satisfy both frameworks simultaneously rather than choosing one.

What is the most common mistake manufacturers make when claiming SSDF conformance?

The most common mistake is adopting SSDF language in policy documents without producing the measurable evidence each practice expects, for example PW.4 (reuse existing well-secured software when feasible) requires documented component selection criteria and provenance records, not just a statement that open-source components are used responsibly. Reviewers and auditors look for artifacts tied to each practice, not paraphrased policy text.

All terms

CybersecurityConnected & Cyber-Physical Devices Software LifecycleSSDF

Secure Software Development Framework

NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

The Secure Software Development Framework (SSDF), published as NIST SP 800-218, is a set of fundamental, sound, secure software development practices grouped into four practice groups: Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV). Each practice has tasks, implementation examples, and references that map to common secure-development standards (OWASP SAMM, BSIMM, ISO/IEC 27034, IEC 62443).

What the regulation says

FDA's Cybersecurity in Medical Devices guidance recommends a Secure Product Development Framework (SPDF) and explicitly accepts SSDF, IEC 81001-5-1, ISO/IEC 27034, and similar frameworks as evidence. The Office of Management and Budget M-22-18 makes SSDF attestation required for U.S. federal software procurement.

What this means in practice

SSDF gained urgency through Executive Order 14028 (Improving the Nation's Cybersecurity), which made SSDF conformance attestation a requirement for software sold to the U.S. federal government. For medical device manufacturers, SSDF is now the most widely accepted vocabulary for describing your secure development lifecycle in a 510(k) or PMA cybersecurity submission. SSDF practices are largely a superset of IEC 81001-5-1 §5, citing both demonstrates breadth and medical-specific depth.

Examples

A MedTech manufacturer uses the SSDF framework to structure its internal secure development lifecycle processes, ensuring that cybersecurity is integrated from initial design through to post-market surveillance.
During a pre-market submission to the FDA for a new medical device, the manufacturer provides documentation demonstrating how its software development practices align with the four practice groups of SSDF.
To comply with federal procurement requirements, a software vendor seeking to sell its health IT solution to a government agency attests that its development processes adhere to SSDF guidelines.

Common pitfalls

•Adopting SSDF in name only, the framework expects measurable practices with evidence (e.g., PW.4 'Reuse Existing, Well-Secured Software When Feasible' requires component selection criteria and provenance records).
•Conflating SSDF with SPDF, SPDF is FDA's umbrella term; SSDF is one specific framework that can satisfy an SPDF requirement.
•Forgetting RV (Respond to Vulnerabilities), many manufacturers' SSDF programs are strong on development but weak on post-market response.

Frequently asked questions

SSDF, published as NIST SP 800-218, organizes practices into Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV), with each practice broken into specific tasks, implementation examples, and references to related standards such as OWASP SAMM, BSIMM, ISO/IEC 27034, and IEC 62443.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

IEC 81001-5-1

International standard defining secure-product-lifecycle activities for health software, including medical devices.

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

Cybersecurity

Secure Product Development Framework(SPDF)

A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.

Cybersecurity

Software Bill of Materials(SBOM)

A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device.

More in Cybersecurity

· Same category

Cybersecurity

Supply-chain Levels for Software Artifacts(SLSA)

OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build.

Cybersecurity

AAMI SW96

AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.

Cybersecurity

AAMI TIR57

AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.

Cybersecurity

AAMI TIR97(TIR97)

AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (2)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 2Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

NIST·1HSCC·1CISA·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Acronym: SSDF
Sources: 3
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance.

·SSDF gained urgency through Executive Order 14028 (Improving the Nation's Cybersecurity), which made SSDF conformance attestation a requirement for software sold to the U.S.
·federal government.
·For medical device manufacturers, SSDF is now the most widely accepted vocabulary for describing your secure development lifecycle in a 510(k) or PMA cybersecurity submission.

Remember this

Watch out: Adopting SSDF in name only, the framework expects measurable practices with evidence (e.g., PW.4 'Reuse Existing, Well-Secured Software When Feasible' requires component selection criteria and provenance records).

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.