Framework
NIST SSDF and OWASP SAMM
Do your customers ask how securely you develop software, and will the Cyber Resilience Act soon require it for every product with digital elements? Complass guides you through the 42 tasks of the NIST SSDF, shows your maturity under OWASP SAMM and links both to the CRA and IEC 62443-4-1.
What is NIST SSDF?
The Secure Software Development Framework (SSDF) is a voluntary framework of the US National Institute of Standards and Technology (NIST SP 800-218). In four groups and 42 tasks it describes how manufacturers develop software securely and respond to vulnerabilities. OWASP SAMM is an open maturity model for software security with 15 practices and levels 0 to 3. There is no certificate for either.
Complass is not affiliated with NIST or the OWASP Foundation. The English task wording is taken from NIST SP 800-218, a freely usable work of the US federal government. OWASP SAMM (owaspsamm.org) is licensed under CC BY-SA 4.0; Complass only names the practices and describes the levels in its own words.
Content as of:
Does it apply to me?
The SSDF concerns manufacturers and developers of software, including firmware and software in machines and devices: companies whose customers want proof of secure development, suppliers to US federal agencies and anyone who wants to implement the development requirements of the Cyber Resilience Act in practice.
The SSDF is not mandatory and replaces neither the CRA nor IEC 62443-4-1. It complements them as a practical task list; you have already implemented many tasks if you develop to IEC 62443-4-1.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Basis
- NIST SP 800-218Secure Software Development Framework (SSDF) version 1.1, February 2022; version 1.2 as a draft since December 2025
- OWASP SAMM v2Software Assurance Maturity Model, licence CC BY-SA 4.0
Key dates
There are no statutory deadlines for the SSDF. If you offer products with digital elements in the EU, keep the Cyber Resilience Act deadlines in mind; the SSDF helps you implement the requirements for development and vulnerability handling in time. We recommend repeating the SAMM assessment every year.
How Complass helps
- 5phases
- 10guided steps
- 3document templates
- 42requirements in the catalogue
Guided in five phases
Scope, prepare the organisation, protect and produce the software securely, respond to vulnerabilities, assess maturity.
42 tasks with implementation guide
Each task with its official identifier, the NIST wording in the original, steps, minimum scope, typical evidence and levels under OWASP SAMM.
Templates
Secure software development policy, SAMM maturity assessment and improvement plan.
Implement once, evidence many times
Complass suggests adopting assessments and evidence from the CRA, IEC 62443-4-1 and ISO 27001 for the SSDF.
The phases in the module
- Starting point and scope
- Prepare the organisation (PO)
- Protect the software and produce it securely (PS, PW)
- Respond to vulnerabilities (RV)
- Assess maturity with OWASP SAMM
Catalogue: NIST SSDF 1.1 – 42 tasks
Matching modules
Compliance management
Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.
Learn moreRisk management
Risk register with qualitative or quantitative assessment, risk appetite and treatment plan, linked to assets, vulnerabilities and incidents.
Learn moreAsset management
IT and OT assets in one place, agentless capture, with SBOM, vendor advisories, end of support, licence reconciliation, identities, relationships and zones per IEC 62443-3-2.
Learn moreFrequently asked questions
Is there an SSDF certificate?
No. Neither the SSDF nor OWASP SAMM can be certified. Complass helps you describe and evidence your implementation status and maturity.
Does the SSDF make us compliant with the Cyber Resilience Act?
Not automatically. The SSDF covers many requirements for development and vulnerability handling, and Complass shows the mapping to Annex I. The conformity assessment under the CRA remains a separate task.
Why SAMM if we have the SSDF?
The SSDF says what to do; SAMM shows how established it is. With levels 0 to 3 you can measure progress and set targets.
We already develop to IEC 62443-4-1. Do we have to record everything again?
No. Through the shared controls, Complass suggests adopting assessments and evidence. You check each suggestion before confirming it.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.