skills.rest
jgsystemsconsulting
jgsystemsconsultingCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

nist-ssdf

Provides reference guidance on NIST SSDF v1.1 secure software development practices.

5|1|Updated Jun 19, 2026
Search Tags:#nist#supply chain security#sbom#vulnerability disclosure#secure sdlc#ssdf#threat modelling
One-click install
npx skills add https://github.com/jgsystemsconsulting/jgs-se-knowledge-packs --skill nist-ssdf-jgsystemsconsulting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: nist-ssdf
Source: https://github.com/jgsystemsconsulting/jgs-se-knowledge-packs/tree/main/packs/nist-ssdf
Command: npx skills add https://github.com/jgsystemsconsulting/jgs-se-knowledge-packs --skill nist-ssdf-jgsystemsconsulting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Engineers and security teams often need NIST SP 800-218 (SSDF) guidance mid-task but cannot recall specific practices, tasks, or implementation examples, forcing them to re-read the full 36-page standard. ## Core Features & Use Cases - Practice lookup by ID: Ask for PO.1, PW.4.4, or RV.3 and get the practice definition, tasks, and implementation guidance from reconstructed reference notes. - Topic-based retrieval: Query threat modelling, SBOM, code signing, compiler hardening, vulnerability disclosure, or supply chain security and receive the relevant chapter content. - Supporting references: Includes a glossary of ~40 terms, 13 When/How/Trade-offs patterns, and a decision-table cheatsheet mapping situations to practices. - Use Case: When onboarding a new supplier, ask about security requirements flow-down and receive PO.1.3 guidance on contract clauses, attestation, and provenance obligations aligned with EO 14028. ## Quick Start Ask the agent to explain SSDF practice PW.4.4 and how to continuously verify third-party components against newly disclosed CVEs.

Frequently Asked Questions about nist-ssdf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I look up a specific NIST SSDF practice like PW.4 or RV.3?▼

Ask for the practice by its ID, such as PO.1, PW.4.4, or RV.3, and the skill returns the practice definition, tasks, and implementation guidance from the corresponding chapter. You can also query by topic or chapter number.

What are the four SSDF practice groups in NIST SP 800-218?▼

The four groups are PO (Prepare the Organization), PS (Protect the Software), PW (Produce Well-Secured Software), and RV (Respond to Vulnerabilities). Together they cover security requirements, code protection, secure design and coding, and post-release vulnerability response.

Does this skill cover NIST CSF or SP 800-53 controls?▼

No. The pack covers only NIST SP 800-218 (SSDF v1.1) and its four practice groups. Referenced standards like NIST CSF, SP 800-53, SP 800-161, IEC 62443, and OWASP ASVS require their own sources for in-depth coverage.

How does SSDF map to EO 14028 compliance requirements?▼

SSDF v1.1 was updated in direct response to EO 14028 Section 4, and Appendix A of the standard maps EO subsections to specific SSDF practice and task IDs. The skill's chapters note these mappings, such as PO.5 addressing EO 4e(i) on securing development environments.

When should I use threat modelling versus static analysis in the SDLC?▼

Threat modelling (PW.1) applies at design time to identify risks before implementation, while static analysis (PW.7) runs as a CI gate on written code. The skill's patterns and cheatsheet explain when each practice applies and their trade-offs.

Related Skills

Explore More Software Engineering Skills→
SempriniSemprini
1

adoption-planning

Assess current data landscape and create a phased MD-DDL adoption roadmap.

Community
Intermediate
daemon-blockint-techdaemon-blockint-tech
7

devsecops

Automate SAST/SCA, SBOM generation, and policy enforcement in CI/CD pipelines.

Community
Advanced
wizelinewizeline

devsec-managing-compliance-frameworks

Map security controls to compliance frameworks and generate audit evidence.

Official
Advanced
wizelinewizeline

devsec-building-security-programs

Assess security maturity with OWASP SAMM and plan security roadmaps.

Official
Advanced