NIST Resources
NIST research, guides and documents for securing the software delivery lifecycle, including AI development, software supply chain security, and DevSecOps.
NIST Cybersecurity Resources and Publications
The National Institute of Standards and Technology (NIST) provides cybersecurity frameworks, standards, and technical guidance to help organizations secure the software development lifecycle. These publications address secure software development, artificial intelligence (AI), software supply chain security, DevSecOps, vulnerability management, and cybersecurity governance.
1. Secure Software Development and DevSecOps
| NIST Publication |
Title |
Description |
Status |
Link |
| SP 800-218 |
Secure Software Development Framework (SSDF) Version 1.1 |
Foundational secure software development practices covering organizational preparation, software protection, secure production, and vulnerability response. |
Final |
NIST Publication |
| SP 800-218 Rev. 1 |
Secure Software Development Framework (SSDF) Version 1.2 |
Proposed updates to the SSDF addressing secure and reliable software development, delivery, and improvement. |
Draft |
NIST Publication |
| SP 800-204D |
Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines |
Guidance for integrating software supply chain security, provenance, attestations, and artifact verification into CI/CD workflows. |
Final |
NIST Publication |
| NIST IR 8397 |
Guidelines on Minimum Standards for Developer Verification of Software |
Recommendations for static analysis, automated testing, fuzzing, threat modeling, and software dependency verification. |
Final |
NIST Publication |
2. AI Development and AI Security
| NIST Publication |
Title |
Description |
Status |
Link |
| SP 800-218A |
Secure Software Development Practices for Generative AI and Dual-Use Foundation Models |
Extends NIST SSDF with secure development practices for AI models and AI-enabled software systems. |
Final |
NIST Publication |
| AI 100-1 |
Artificial Intelligence Risk Management Framework (AI RMF 1.0) |
Framework for identifying, assessing, managing, and governing risks associated with AI systems throughout their lifecycle. |
Final |
NIST Publication |
| AI 600-1 |
Generative Artificial Intelligence Profile |
Guidance for managing risks introduced by generative AI, including security, privacy, reliability, and misuse. |
Final |
NIST Publication |
| AI 100-2e2025 |
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations |
Describes adversarial AI attacks, including data poisoning, evasion, privacy attacks, and attacks against generative AI systems. |
Final |
NIST Publication |
| SP 2400-102e2026 |
Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations |
Draft guidance expanding adversarial AI security terminology and attack classifications, including agentic AI system threats. |
Draft |
NIST Announcement |
3. Software Supply Chain Security
| NIST Publication |
Title |
Description |
Status |
Link |
| SP 800-161 Rev. 1 |
Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations |
Guidance for identifying, assessing, and mitigating cybersecurity risks associated with software suppliers, components, products, and services. |
Final |
NIST Publication |
| SP 800-204D |
Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines |
Practical strategies for protecting software repositories, build systems, dependencies, artifacts, and CI/CD workflows. |
Final |
NIST Publication |
| SP 800-218 |
Secure Software Development Framework (SSDF) |
Secure development practices that help organizations manage software vulnerabilities and supply chain risks. |
Final |
NIST Publication |
| SP 800-190 |
Application Container Security Guide |
Security considerations for container images, registries, container runtime environments, and container orchestration. |
Final |
NIST Publication |
4. Post-Deployment Vulnerability Management
| NIST Publication |
Title |
Description |
Status |
Link |
| SP 800-40 Rev. 4 |
Guide to Enterprise Patch Management Planning |
Guidance for identifying, prioritizing, deploying, and verifying security patches and software updates. |
Final |
NIST Publication |
| SP 800-216 |
Recommendations for Federal Vulnerability Disclosure Guidelines |
Guidance for receiving, assessing, tracking, communicating, and resolving reported vulnerabilities. |
Final |
NIST Publication |
| SP 800-53 Rev. 5 |
Security and Privacy Controls for Information Systems and Organizations |
Security controls covering continuous monitoring, vulnerability scanning, configuration management, flaw remediation, and system integrity. |
Final |
NIST Publication |
| SP 800-190 |
Application Container Security Guide |
Recommendations for securing deployed containers, container hosts, images, and runtime environments. |
Final |
NIST Publication |
| SP 800-218 |
Secure Software Development Framework (SSDF) |
Includes practices for responding to vulnerabilities in released software and preventing recurrence. |
Final |
NIST Publication |
5. Cybersecurity Governance and Risk Management
| NIST Publication |
Title |
Description |
Status |
Link |
| CSWP 29 |
NIST Cybersecurity Framework (CSF) 2.0 |
Framework for governing, identifying, protecting against, detecting, responding to, and recovering from cybersecurity risks. |
Final |
NIST Publication |
| SP 800-53 Rev. 5 |
Security and Privacy Controls for Information Systems and Organizations |
Catalog of security and privacy controls for secure operations, monitoring, vulnerability management, and risk reduction. |
Final |
NIST Publication |
| SP 800-161 Rev. 1 |
Cybersecurity Supply Chain Risk Management Practices |
Enterprise-level practices for managing supply chain security risks and supplier relationships. |
Final |
NIST Publication |
| AI 100-1 |
Artificial Intelligence Risk Management Framework |
Governance and management of risks involving AI development, deployment, and use. |
Final |
NIST Publication |
6. NIST Resources Mapped to the CI/CD Cybersecurity Guide
The following table maps relevant NIST publications to the three phases of the CI/CD Cybersecurity Guide.
| CI/CD Phase |
Security Focus |
Recommended NIST Publications |
| Phase 1: Code and Prebuild |
Secure coding, threat modeling, dependency security, AI development, and security planning. |
SP 800-218, SP 800-218A, IR 8397, AI 100-1, AI 600-1, AI 100-2 |
| Phase 2: Build and Deploy |
Software supply chain security, SBOMs, provenance, artifact integrity, automated security testing, and container security. |
SP 800-204D, SP 800-161 Rev. 1, SP 800-218, SP 800-190 |
| Phase 3: Post Deployment |
Continuous vulnerability management, runtime security, vulnerability disclosure, patch management, and remediation verification. |
SP 800-40 Rev. 4, SP 800-216, SP 800-53 Rev. 5, SP 800-190, SP 800-218 |