Lion Cipher Lab

Build a secure-development program with the NIST SSDF

• GRC / Compliance
• Intermediate
• ~60 min
• Free · no account required

Why it matters

If your company ever wants to sell software to the US government, someone has to sign a form swearing your development process follows the NIST SSDF. That form is not optional and the person who signs it is personally on the hook. More broadly, 'we have a secure SDLC' is a claim every serious buyer, auditor and cyber-insurer now tests — and the SSDF is the shared vocabulary they test it in. Learning to run the framework over a real pipeline turns a vague aspiration ('we do security stuff in CI') into a defensible, evidence-backed program you can show to anyone. It is the governance umbrella…

What you'll learn

• what the NIST SSDF (SP 800-218 v1.1) is: high-level secure-development PRACTICES, not a checklist of tools
• the four practice groups — Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), Respond to Vulnerabilities (RV)
• mapping a team's existing SDLC to each practice group and scoring implemented / partial / gap with evidence
• producing an SSDF gap worksheet you can hand to an auditor or a program lead
• the real-world driver: EO 14028, OMB M-22-18 / M-23-16, and the CISA Secure Software Development Attestation Form
• why an outcome-based framework is portable across languages and stacks, and how it maps to SLSA, OWASP SAMM and BSIMM

Steps in this lab

1. What the SSDF actually is (and what it is not)
2. The four practice groups, at a glance — PO, PS, PW, RV
3. Why practices-not-tools, and when you would reach for this
4. The real-world driver: EO 14028, OMB memos, and the CISA attestation form
5. Build the SSDF gap worksheet
6. Walk PO — Prepare the Organization — and score it
7. Walk PS — Protect the Software — and score it
8. Walk PW — Produce Well-Secured Software — and score it
9. Walk RV — Respond to Vulnerabilities — and score it
10. When NOT to over-rely on it — the honest limits
11. The way a pro does it — and where this connects

Open the full interactive lab →