Complass
Secure software development under NIST SSDF and OWASP SAMM: the practical route to the CRA
The US client asks for an SSDF self-attestation, the CRA for a secure development process, the customer for IEC 62443-4-1. How a manufacturer produces the evidence once and uses it several times.
The Secure Software Development Framework (NIST SP 800-218, version 1.1) describes in 42 tasks how manufacturers develop software securely and respond to vulnerabilities; OWASP SAMM adds a maturity scale from 0 to 3. It is voluntary and not certifiable but fits the CRA and IEC 62443-4-1.
The whitepaper explains the four groups and 19 practices, the maturity, the mapping to the CRA and IEC 62443-4-1 and the evidence from the toolchain, with a 10-step plan and a practice example.
7 pages · Version 0.9 · as of 18.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.