Building Secure Software by Design: SSDF Support Now in Preview on Chainloop

What is the SSDF?

The Secure Software Development Framework (SSDF), published by NIST, defines a set of best practices for building software that is secure by design. It’s structured around four core areas:

• Prepare the Organization (PO)
• Protect the Software (PS)
• Produce Well-Secured Software (PW)
• Respond to Vulnerabilities (RV).

It includes guidance for both technical and organizational implementation. Although conceptual in nature, the SSDF provides practical examples and suggested activities to help teams operationalize secure development practices. The diagram below summarizes these activities by practice and maps them to stages of the software development life cycle (SDLC).

From Guidance to Mandate

SSDF v1.0 was published in 2020 as a voluntary framework. Executive Order 14028 (2021) and its successors accelerated adoption across the U.S. federal government. In 2022, SSDF v1.1 aligned directly with federal cybersecurity goals, and OMB Memo M-22-18 made it a requirement for federal software suppliers, relying initially on self-attestation. The latest policy update, EO 14144 (2025), signals a transition to more verifiable and auditable compliance, raising the bar for software producers everywhere.

SSDF Support in Preview on Chainloop

Chainloop is introducing preview support for the SSDF framework to help teams get ahead of emerging compliance requirements by making it easier to assess, track, and document secure-by-design practices without disrupting their existing workflows.

At its core, the SSDF is supported in Chainloop as a self-assessment checklist aligned with NIST’s official guidance spreadsheet. You can upload supporting evidence for each practice manually such as policy documents, audit logs, or penetration test reports, helping you document current controls and identify gaps. This makes it easier to align with federal self-attestation expectations today, and paves the way toward verifiable compliance tomorrow.

We’re also introducing expanded manual evidence and automated policies that verify that your vulnerability management process follows industry-recommended practices that support compliance with the SSDF mapped directly to the Respond to Vulnerabilities (RV) category.

A project leveraging Chainloop for its build, test, release, and post-release activities, along with SSDF compliance tracking, will typically follow this structure:

This integration gives you confidence that your security practices align with industry expectations and that you’re generating compliance-ready evidence as a natural part of your software delivery process.

What’s Next

Check our reference and user guide and give it a try. You can also book a demo with our team to discover Chainloop’s next-generation compliance tooling.

Also, this is just the beginning! We are adding deeper automation, expanded compliance mappings, and improved reporting. Contact us to get early access to these new features.