Control mapping available
NIST CSF & SSDF
NIST Cybersecurity Framework 2.0 and Secure Software Development Framework (SP 800-218)
NIST CSF 2.0 organizes security outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The SSDF (SP 800-218) lists secure development practices and underpins the software attestation and SBOM expectations that followed US Executive Order 14028.
Applies to: US federal suppliers, and any organization that wants a widely recognized security baseline.
What to Know
- CSF 2.0 (February 2024) added the Govern function and broadened the scope beyond critical infrastructure.
- SSDF practices are grouped as Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW), and Respond to Vulnerabilities (RV).
- Federal software suppliers attest to SSDF practices using the CISA Secure Software Development Attestation Form.
Controls Lionhouse Helps With
The engineering-owned controls where continuous evidence saves the most time. Policies, training, and physical controls are tracked in trustlynce too.
| Reference | Control | How Lionhouse helps | Products |
|---|---|---|---|
| SSDF PS.3 / PW.4 | Provenance and reuse of well-secured components | TrustIvan generates SBOMs and signs images and SBOMs with Cosign and in-toto attestations. | TrustIvan |
| SSDF RV.1 | Identify and confirm vulnerabilities on an ongoing basis | Continuous scanning in CI and registries, with triage that survives rebuilds. | TrustIvan |
| CSF DE.CM | Continuous monitoring | aiAxonIQ monitors services through OpenTelemetry with forecast-based anomaly detection. | aiAxonIQ |
| CSF GV.SC | Cybersecurity supply chain risk management | trustlynce vendor risk profiles plus TrustIvan SBOMs cover suppliers and software components. | trustlynce, TrustIvan |
Lionhouse helps you prepare and maintain evidence. Your auditor or certification body makes the final determination.
Other Frameworks
Talk to an Architect
See the Four Products Running in Your Environment.
A technical session with a Lionhouse architect covering your stack, your deployment model, and a pilot plan.