Cybersecurity Policy Report, NIST Consortium Focuses on Secure Software Development, Deployment, (Jul 30, 2025)
The National Institute of Standards and Technology today issued draft guidance on secure software development and announced that it had formed a public-private consortium to develop further recommendations on software security.
NIST’s work on software security, including the 2022 publication of a secure software development framework (SSDF), is being conducted pursuant to executive orders issued under the Biden and Trump administrations, NIST noted in a news release.
The draft guidance released today, “Secure Software Development, Security, and Operations (DevSecOps) Practices,” builds on the SSDF by offering specific examples of how to create a secure software development environment, it said.
“While the SSDF provides a core set of high-level secure software development practices, it does not go into detail about how an organization might create a secure development environment that fits the organization’s objectives,” it explained.
“The SSDF looks at building software holistically, helping organizations figure out what needs to be done to make their development environment more secure, how to protect it and find deficiencies that make it vulnerable,” said Alper Kerman, a project manager at NIST’s National Cybersecurity Center of Excellence (NCCoE), which is leading the software security project.
“The draft guidelines we are developing will show how organizations can use commercial, off-the-shelf technologies and AI capabilities and apply zero trust principles and methodologies to create an efficient and secure development environment for producing fast and more reliable software,” Mr. Kerman said.
“You have to have an environment to write code in, where the whole team of developers can access it and update the code in an agile fashion,” he added. “But when you are writing code, a team member might bring in code libraries from other parties, for example. We will outline best practices for minimizing the likelihood that vulnerabilities might creep in as a result, such as effective ways to scan the code for trouble spots.”
Comments on the draft guidance are due by Sept. 12 and can be submitted to nccoe-devsecops@list.nist.gov.
NCCoE worked with 14 software vendors to develop the draft guidance, and the group will issue future publications as part of the project.
“The group’s objective is to develop guidelines that will help improve security at all stages of the software development life cycle, from a software product’s initial planning and testing to its deployment, operation and maintenance in real-world environments,” according to NCCoE.
NIST is also planning to hold a virtual event on Aug. 27 at 1 p.m. EDT “to highlight the project’s goals, as well as gather feedback and additional insight for the project,” it said. “In addition, NIST invites the public to join its Community of Interest. Participation in the project is open to all interested organizations.”
News: FederalLegislation DataSecurity