U.S. CISA Secure Software Development Attestation Form (SSDAF) — Secure Software Self-Attestation Requirements
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting. Framework text may require a separate license unless explicitly provided.
Overview
The U.S. CISASecure Software Development Attestation Form (SSDAF) — SecureSoftware Self-Attestation Requirements is a federal cybersecuritycompliance requirement that enables organizations to formally attestto the use of secure software development practices when supplyingsoftware to the U.S. government. This form supports the government’sinitiative to reduce software supply chain risks and strengthennational cybersecurity posture.
Published by theCybersecurity and Infrastructure Security Agency (CISA), the SSDAFapplies to federal contractors, software vendors, and suppliersaiming to provide software or software services to governmentagencies. It covers secure software development controls, riskmanagement practices, and compliance with guidance such as ExecutiveOrder 14028 and related NIST standards.
Organizationscomplete the SSDAF by documenting and attesting to theirimplementation of secure software development controls, aligningtheir practices with CISA and NIST guidance. Integrating SSDAFrequirements into software development lifecycles, securitydocumentation, and vendor risk management programs supportsregulatory compliance and provides assurance to federal buyers.
Why it Matters
The U.S. CISASecure Software Development Attestation Form (SSDAF) strengthenstrust by ensuring organizations follow secure software developmentpractices and regulatory requirements.
Key benefitsinclude:
• Support stronger supply chain security
Require softwareproviders to attest to secure development, limiting risks fromthird-party software procurement and integration.
• Enhance regulatory compliance
Enableorganizations to demonstrate alignment with federal cybersecuritystandards, improving their ability to meet compliance obligationsduring audits.
• Increase software transparency
Promote greatervisibility into suppliers' development practices, enabling informedrisk management and procurement decisions.
• Improve incident response readiness
Mandate securedevelopment controls that reduce exploitable vulnerabilities andsupport more effective detection and remediation of software-basedthreats.
• Strengthen organizational reputation
Provideassurance to customers and stakeholders regarding the securityintegrity of deployed software products and internal developmentprocesses.
How it Works
The U.S. CISASecure Software Development Attestation Form (SSDAF) structuressecure software development requirements around a set of securitycontrols, process safeguards, and regulatory criteria aligned withexecutive orders and federal guidelines. The framework establishes aformal lifecycle for assessing software supply chain risks andcodifies key security practices into defined domains such as sourcecode integrity, vulnerability management, and secure developmentmethods. Organizations are required to self-attest to theimplementation of these controls as part of compliance with federalprocurement requirements.
In practice,organizations apply the SSDAF by integrating its control requirementsinto their secure development lifecycle (SDLC), mapping theframework’s standards to internal governance policies, andconducting regular compliance assessments. Security teams implementcontrols such as code review processes, automated vulnerabilityscanning, and developer training to address compliance gaps. Ongoingmonitoring and document collection support continuous alignment withSSDAF expectations and facilitate timely incident response andremediation.
ThroughSmartSuite, organizations streamline SSDAF operationalization byleveraging pre-built control libraries tailored to secure softwaredevelopment, managing risks within configurable registers, andenforcing policy governance workflows. The platform’s evidencecollection features support audit readiness, while compliancetracking modules and reporting dashboards enable ongoing monitoringof software supply chain security practices and regulatory adherence.
Key Elements
• Secure Software Development Practices
Specifiesrequired processes for building software that address securityconsiderations throughout the development lifecycle.
• Supplier Risk Management Controls
Outlinesmechanisms for evaluating and managing third-party and supply chainsoftware risks.
• Secure Software Design Standards
Establishesminimum standards for secure architecture and coding within developedapplications.
• Vulnerability Management Requirements
Describesprocedures for identifying, disclosing, and remediatingvulnerabilities in delivered software.
• Continuous Monitoring Activities
Provides forongoing oversight and review of software to ensure continuedcompliance with security requirements.
• Attestation and Documentation Processes
Definesnecessary evidence and documentation to support self-attestation ofsecure software development.
Framework Scope
The U.S. CISASecure Software Development Attestation Form (SSDAF) is adopted bysoftware producers contracting with U.S. federal agencies, addressingthe development and delivery of secure software running on federalinformation systems and cloud services. Organizations typicallycomplete the SSDAF when demonstrating control effectiveness andmeeting federal supply chain security requirements.
Framework Objectives
The U.S. CISASecure Software Development Attestation Form (SSDAF) defines keyoutcomes for secure software practices and organizational compliance.
• Strengthen cybersecurity governance through formalized securesoftware development processes
• Enhance risk management by addressing vulnerabilities insoftware supply chains
• Promote regulatory compliance with federal security and privacyrequirements
• Improve data protection through implementation of robustsecurity controls
• Support operational resilience by ensuring software integrityand trustworthiness
• Demonstrate audit readiness and transparency in softwaredevelopment practices The U.S. CISA Secure Software DevelopmentAttestation Form (SSDAF) aligns with secure development practicesfound in NIST SP 800-218, NIST SP 800-53, and the OWASP SoftwareAssurance Maturity Model. Organizations typically implement SSDAF tofulfill federal procurement requirements, regulatory compliance, orto demonstrate secure software development practices to governmentcustomers.
Common Framework Mappings
The U.S. CISASecure Software Development Attestation Form is often mapped torecognized software security and risk management frameworks todemonstrate comprehensive security practices, ensure regulatoryalignment, and streamline compliance reporting.
Mappedframeworks include:
CIS CriticalSecurity Controls
FedRAMP
ISO/IEC 27001
ISO/IEC 27002
NISTCybersecurity Framework
NIST SP 800-161
NIST SP 800-218Secure Software Development Framework (SSDF)
NIST SP 800-53
PCI DSS
SOC 2
- ClassicifationCategorySoftware SecurityDomainSoftware SecurityFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentProgramSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherCybersecurity and Infrastructure Security Agency (CISA)
- VersioningVersion2024Effective DateMarch 11, 2024Issue DateMarch 11, 2024
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityModerate
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
CISA publishes the SSDAF on its website and is publicly available for free download from the U.S. CISA. License included with platform
How SmartSuite Supports CISA SSDAF
Manage secure software development attestations required by U.S. federal agencies by organizing SSDAF requirements, tracking development practices, and maintaining evidence supporting secure software supply chain assurances.
Secure Development Requirement Library
Structure SSDAF secure software development requirements with mapped controls and responsible owners.
Secure Software Development Lifecycle Governance
Track security activities across design, coding, testing, and deployment stages of software development.
Vulnerability and Dependency Management
Monitor software vulnerabilities, open-source dependencies, and remediation workflows across development pipelines.
Build Integrity and Release Governance
Document build processes, code signing, artifact integrity checks, and release approvals.
Third-Party Software and SBOM Tracking
Track third-party software components, vendor security attestations, and SBOM documentation.
SSDAF Federal Software Security Attestation Readiness
Provide dashboards showing SSDAF requirement coverage, evidence status, and readiness for federal software security attestations.
Related frameworks
CIS Controls v8.1 provides prioritized, practical security actions to help organizations mitigate common cyber threats and strengthen defenses.
FedRAMP standardizes security requirements to assess, authorize, and continuously monitor cloud services that handle U.S. federal data.
ISO/IEC 27001:2022 is an international ISMS standard that helps organizations manage information security risks and protect data.
ISO/IEC 27002:2022 provides best-practice information security controls to help organizations select, implement, and manage protections for information assets.
NIST SP 800-171 defines security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and organizations.
NIST SP 800-53 Rev. 5 provides a catalog of security and privacy controls to manage risks to information systems.
Frequently Asked Questions For U.S. CISA Secure Software Development Attestation Form (SSDAF)
The SSDAF is used to confirm that software producers have implemented secure software development practices as required under U.S. federal guidance, particularly for software provided to federal agencies. The form is designed to promote transparency and accountability by requiring organizations to self-attest to their software security practices.
Yes, completion and submission of the SSDAF is mandatory for organizations wishing to provide software to U.S. federal agencies, in line with Executive Order 14028 and OMB Memorandum M-22-18. Non-compliance can result in disqualification from federal procurement processes.
The SSDAF applies to all software producers whose products are used by U.S. federal agencies, including both commercial off-the-shelf and custom-developed software. It covers both new and existing software that is subject to federal acquisition.
Organizations must provide a completed attestation form and demonstrate adherence to secure software development practices, such as threat modeling, code review, vulnerability remediation, and supply chain security. Evidence may include documentation of policies, procedures, and technical controls supporting secure development.
Organizations should align their software development lifecycle with secure-by-design principles, integrating security controls such as secure coding standards, automated security testing, and third-party component risk assessments. Regular training and process reviews are also essential to ensuring continued compliance.
The SSDAF draws on requirements from frameworks such as NIST SP 800-218 (Secure Software Development Framework) and aligns with federal security mandates, but it does not replace other certification regimes (like FedRAMP or FISMA). Organizations may reference existing controls and processes already implemented under these standards when completing the SSDAF.
Organizations must maintain secure software development practices continuously and update their attestation as changes occur. Periodic review, monitoring for emerging threats, and ongoing documentation are required to remain compliant with SSDAF obligations.
SmartSuite can assist organizations in managing SSDAF compliance by providing centralized tracking of risks and controls, managing evidence collection across development teams, and supporting audit readiness with robust documentation. Automated workflows and reporting capabilities streamline ongoing compliance and demonstrate adherence to SSDAF requirements to auditors and regulators.
Put CRI Profile into action with SmartSuite
Map controls, collect evidence, run assessments, manage remediation, and report readiness - all from a single connected system.