NIST SP 800-218: every control, and what you already have

42 controls 26 frameworks share controls with it United States verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

NIST SP 800-218 Secure Software Development Framework Evidence & Implementation Kit

42 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
C5 (Germany)	42	measure it →
ISO 27001:2022	42	measure it →
ISO 27002:2022	42	measure it →
NIST Cybersecurity Framework 2.0	42	measure it →
NIST SP 800-161 Rev 1	42	measure it →
NIST SP 800-53 Rev 5	42	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	41	measure it →
FedRAMP High	40	measure it →
FedRAMP Moderate	40	measure it →
NIST SP 800-53 Rev 5 MODERATE	38	measure it →
NIST SP 800-53 Revision 5.1 HIGH	38	measure it →
Azure Security Benchmark	35	measure it →

Every control

Code	Control	Also in
`SP800-218-PO.1.1`	Define Security Requirements for Software Development	22
`SP800-218-PO.1.2`	Implement Security Requirements in the Toolchain	17
`SP800-218-PO.1.3`	Communicate Requirements to Third-Party Providers	19
`SP800-218-PO.2.1`	Roles and Responsibilities for Secure Development	19
`SP800-218-PO.2.2`	Training and Skills Maintenance	22
`SP800-218-PO.2.3`	Obtain Management Commitment to Secure Development	17
`SP800-218-PO.3.1`	Supporting Toolchain Selection	14
`SP800-218-PO.3.2`	Toolchain Configuration and Integration	18
`SP800-218-PO.3.3`	Toolchain Generates Security Artifacts	13
`SP800-218-PO.4.1`	Criteria for Software Security	19
`SP800-218-PO.4.2`	Gather and Safeguard Security Check Information	15
`SP800-218-PO.5.1`	Secure Development Environment Implementation	16
`SP800-218-PO.5.2`	Harden Development Endpoints	18
`SP800-218-PS.1.1`	Protect All Forms of Code from Unauthorized Modification	20
`SP800-218-PS.2.1`	Provide a Mechanism for Verifying Software Release Integrity	16
`SP800-218-PS.3.1`	Archive and Protect Released Software	15
`SP800-218-PS.3.2`	Software Bill of Materials	18
`SP800-218-PW.1.1`	Design Software to Meet Security Requirements	22
`SP800-218-PW.1.2`	Track Security Requirements, Risks, and Decisions	15
`SP800-218-PW.1.3`	Support Standardized Security Features	18
`SP800-218-PW.2.1`	Qualified Review of Software Design	19
`SP800-218-PW.4.1`	Reuse Trusted Software Components	20
`SP800-218-PW.4.2`	Maintain Well-Secured In-House Components	15
`SP800-218-PW.4.4`	Verify Acquired Components Meet Security Requirements	20
`SP800-218-PW.5.1`	Secure Coding Practices	20
`SP800-218-PW.6.1`	Configure Compilation and Build Processes Securely	11
`SP800-218-PW.6.2`	Configure Build Tool Security Features	12
`SP800-218-PW.7.1`	Code Review	20
`SP800-218-PW.7.2`	Perform Code Review and Analysis	21
`SP800-218-PW.8.1`	Executable Testing for Security	22
`SP800-218-PW.8.2`	Execute Security Testing	19
`SP800-218-PW.9.1`	Configure Software to Have Secure Settings by Default	16
`SP800-218-PW.9.2`	Implement and Document Secure Defaults	15
`SP800-218-RV.1.1`	Identify and Confirm Vulnerabilities on an Ongoing Basis	21
`SP800-218-RV.1.2`	Review and Analyze Code for Vulnerabilities	19
`SP800-218-RV.1.3`	Vulnerability Disclosure Policy	18
`SP800-218-RV.2.1`	Assess, Prioritize, and Remediate Vulnerabilities	22
`SP800-218-RV.2.2`	Develop and Implement Remediation Plans	19
`SP800-218-RV.3.1`	Analyze Vulnerabilities to Identify Root Causes	11
`SP800-218-RV.3.2`	Identify and Fix Similar Vulnerabilities	10
`SP800-218-RV.3.3`	Review SDLC to Prevent Recurrence	17
`SP800-218-RV.3.4`	Document Lessons Learned	18

Tell me when NIST SP 800-218 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Patch management procedure
Patch cadence schedule
Exception register with risk acceptance
Verification reports
Vulnerability scan reports
Patch deployment records

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Exceptions never expire named by 3 frameworks

What this page is

A control-level reference for NIST SP 800-218, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition