--- title: "SSDF, Secure Software Development Framework | MedTech Terms" description: "NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/ssdf#term", "name": "Secure Software Development Framework", "alternateName": [ "SSDF", "NIST SP 800-218", "NIST SSDF" ], "description": "The Secure Software Development Framework (SSDF), published as NIST SP 800-218, is a set of fundamental, sound, secure software development practices grouped into four practice groups: Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV). Each practice has tasks, implementation examples, and references that map to common secure-development standards (OWASP SAMM, BSIMM, ISO/IEC 27034, IEC 62443).", "url": "https://medtechterms.com/terms/ssdf", "termCode": "ssdf", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/ssdf#article", "headline": "SSDF, Secure Software Development Framework", "description": "NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance.", "url": "https://medtechterms.com/terms/ssdf", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/ssdf" }, "about": { "@id": "https://medtechterms.com/terms/ssdf#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Secure Software Development Framework, SSDF, NIST SP 800-218, NIST SSDF, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-06-20", "dateModified": "2026-06-20", "citation": [ { "@type": "CreativeWork", "name": "NIST SP 800-218: SSDF v1.1", "url": "https://csrc.nist.gov/publications/detail/sp/800-218/final", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "HSCC - Health Sector Coordinating Council", "url": "https://healthsectorcouncil.org/", "publisher": { "@type": "Organization", "name": "HSCC" } }, { "@type": "CreativeWork", "name": "CISA - Healthcare and Public Health Sector", "url": "https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector", "publisher": { "@type": "Organization", "name": "CISA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "url": "https://medtechterms.com/terms/spdf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/secure-by-design#term", "name": "Secure-by-Design (Devices)", "url": "https://medtechterms.com/terms/secure-by-design" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/sbom#term", "name": "Software Bill of Materials", "alternateName": "SBOM", "url": "https://medtechterms.com/terms/sbom" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/slsa#term", "name": "Supply-chain Levels for Software Artifacts", "alternateName": "SLSA", "url": "https://medtechterms.com/terms/slsa" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Secure Software Development Framework", "item": "https://medtechterms.com/terms/ssdf" } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Secure Software Development Framework [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Software Lifecycle](/ecosystems/software-lifecycle)SSDF # Secure Software Development Framework NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed June 20, 2026 ## Definition The Secure Software Development Framework (SSDF), published as NIST SP 800-218, is a set of fundamental, sound, secure software development practices grouped into four practice groups: Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV). Each practice has tasks, implementation examples, and references that map to common secure-development standards (OWASP SAMM, BSIMM, ISO/IEC 27034, IEC 62443). What the regulation says FDA's Cybersecurity in Medical Devices guidance recommends a [Secure Product Development Framework](/terms/spdf) (SPDF) and explicitly accepts SSDF, [IEC 81001-5-1](/terms/iec-81001-5-1), ISO/IEC 27034, and similar frameworks as evidence. The Office of Management and Budget M-22-18 makes SSDF attestation required for U.S. federal software procurement. ## What this means in practice SSDF gained urgency through Executive Order 14028 (Improving the Nation's Cybersecurity), which made SSDF conformance attestation a requirement for software sold to the U.S. federal government. For medical device manufacturers, SSDF is now the most widely accepted vocabulary for describing your secure development lifecycle in a 510(k) or [PMA](/terms/pma) cybersecurity submission. SSDF practices are largely a superset of [IEC 81001-5-1](/terms/iec-81001-5-1) §5, citing both demonstrates breadth and medical-specific depth. Common pitfalls - • Adopting SSDF in name only, the framework expects measurable practices with evidence (e.g., PW.4 'Reuse Existing, Well-Secured Software When Feasible' requires component selection criteria and provenance records). - • Conflating SSDF with SPDF, SPDF is FDA's umbrella term; SSDF is one specific framework that can satisfy an SPDF requirement. - • Forgetting RV (Respond to Vulnerabilities), many manufacturers' SSDF programs are strong on development but weak on post-market response. ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity IEC 81001-5-1 International standard defining secure-product-lifecycle activities for health software, including medical devices. ](/terms/iec-81001-5-1)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Secure Product Development Framework(SPDF) A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. ](/terms/spdf)[ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. ](/terms/sbom) ### More in Cybersecurity · Same category [ Cybersecurity Supply-chain Levels for Software Artifacts(SLSA) OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build. ](/terms/slsa)[ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97) Cited by Where this term appears across MedTech Terms. Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 NIST· 1 HSCC· 1 CISA· 1 1. [1 NIST SP 800-218: SSDF v1.1 Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/publications/detail/sp/800-218/final) 2. [2 HSCC - Health Sector Coordinating Council Verified HSCC · healthsectorcouncil.org ](https://healthsectorcouncil.org/) 3. [3 CISA - Healthcare and Public Health Sector Verified CISA · cisa.gov ](https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym SSDF Sources 3 Updated 6/20/2026 [Compare with another term](/compare?a=ssdf) Learn in 60 seconds Card Lesson Quiz NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance. - · SSDF gained urgency through Executive Order 14028 (Improving the Nation's Cybersecurity), which made SSDF conformance attestation a requirement for software sold to the U.S. - · federal government. - · For medical device manufacturers, SSDF is now the most widely accepted vocabulary for describing your secure development lifecycle in a 510(k) or PMA cybersecurity submission. Remember this Watch out: Adopting SSDF in name only, the framework expects measurable practices with evidence (e.g., PW.4 'Reuse Existing, Well-Secured Software When Feasible' requires component selection criteria and provenance records). Related terms - [Secure Product Development Framework(SPDF) ](/terms/spdf) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) - [Secure-by-Design (Devices) ](/terms/secure-by-design) - [Software Bill of Materials(SBOM) ](/terms/sbom) - [Supply-chain Levels for Software Artifacts(SLSA) ](/terms/slsa) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) You may also need Auto-suggested from Cybersecurity and shared keywords. - [NIST IR 8473, Cybersecurity Framework Profile for HPH(NIST IR 8473) ](/terms/nist-cswp-35) - [Health Industry Cybersecurity Practices(HICP) ](/terms/hicp) - [Healthcare and Public Health Cybersecurity Performance Goals(HPH-CPG) ](/terms/hph-cpg) - [NIST Cybersecurity Framework(NIST CSF) ](/terms/nist-csf) - [Software Safety Case ](/terms/software-safety-case) - [HITRUST CSF(HITRUST) ](/terms/hitrust) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)