U.S. National Institute of Standards and Technology · Version 1.1

NIST Secure Software Development Framework (SP 800-218): real-world incidents for each item

The SSDF asks producers to assess design risk before building (PW.1.1) and to learn from root causes so the same class of problem does not recur (RV.3). CollectSEA applies the second practice across organizations: other teams' root causes become your design-time checks.

Official NIST SSDF
  1. PW.1.1

    Use risk modeling during design

    Use forms of risk modeling, such as threat modeling, attack modeling or attack surface mapping, to help assess the security risk for the software.

    Applies to every failure pattern: each CollectSEA analysis is a way to carry out this item. See all patterns.

  2. RV.1.1

    Gather vulnerability information from public sources

    Gather information from users and public sources on potential vulnerabilities in the software and its third-party components.

    and 2 more in the linked patterns.

  3. RV.2.2

    Plan and implement risk responses

    Plan and implement risk responses for vulnerabilities.

    and 2 more in the linked patterns.

  4. RV.3.2

    Analyze root causes over time

    Analyze root causes over time to identify patterns, such as a secure practice not being followed consistently.

    Applies to every failure pattern: each CollectSEA analysis is a way to carry out this item. See all patterns.

  5. RV.3.4

    Update the development process

    Review the development process and update it to prevent the root cause from recurring in new software.

    and 17 more in the linked patterns.

Mappings are CollectSEA's own analysis and are not produced or endorsed by U.S. National Institute of Standards and Technology. Item names and summaries paraphrase the official text; consult the source for the authoritative wording.