Security · United States (NIST)

NIST SP 800-218 (SSDF v1.1)

Attestkeep maps what your cluster's admission control and image scanning recorded in a period to 13 clauses of NIST SP 800-218 v1.1. 11 are assessed from those records; 2 are marked outside scope, each with the reason.

Create an account How a package is built

What the framework asks

11 clauses a cluster can answer.

Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.

Secure Software Development Framework

NIST SP 800-218 v1.1

PO.3 and PO.5, PS.1 to PS.3, PW.4, and RV.1 to RV.2 — the practices that reach past the build into what is deployed

Citation	Clause	Report sections
PO.3.2	Deploy and maintain the toolchain Follow recommended security practices to deploy, operate and maintain tools and toolchains, and ensure they are operating as intended.	AvailabilityEvidence chain
PO.5.1	Separate and protect the environments used for software Use multi-factor, risk-based authentication and conditional access for each environment, and restrict who may change it.	Evidence chain
PS.1.1	Protect all forms of code from unauthorized access and tampering Store code based on the principle of least privilege, and verify that what is deployed is what was released.	Supply chainControl statement
PS.2.1	Provide a mechanism for verifying software release integrity Post cryptographic hashes or sign releases, so that consumers can verify that the software they run is the software that was released.	Supply chainControl statement
PS.3.1	Archive and protect each software release Archive the release and the provenance data for it, so that the release can be identified and its origin established later.	Supply chainControl statementEvidence chain
PS.3.2	Collect and maintain provenance data for components Make provenance data — including a software bill of materials — available for the components a release is assembled from.	Supply chain
PW.4.1	Acquire well-secured components from commercial or open-source sources Reuse components from sources that are known and trusted, and check that each acquired component comes from where it claims to.	Control statementSupply chain
PW.4.4	Verify that acquired components comply with requirements Verify each acquired component against the organization's security requirements before it is used, and continue to do so over its life.	CoverageAdmission decisionsOutcomes
RV.1.1	Gather information about potential vulnerabilities Continuously monitor sources of vulnerability information about the software and the components it depends on.	Coverage
RV.1.2	Confirm and prioritize each vulnerability Review, confirm, prioritize and record each reported vulnerability, so that the response is proportionate and traceable.	CoverageAdmission decisionsOutcomesTriage decisionsEvidence chain
RV.2.1	Analyze and plan the remediation of each vulnerability Analyze each vulnerability to determine the response, and act within a defined timeframe.	Control statementAdmission decisionsIssuesBreak-glass events

2 clauses marked outside scope, and why

Citation	Clause and reason
PW.1 to PW.3, PW.5 to PW.9	Design, review, and test the software itself these practices govern how software is written and reviewed before it becomes an image; this document reports on what a cluster admitted, which is downstream of every one of them
RV.3.3	Review the root cause of vulnerability classes root-cause analysis is a producer activity carried out on source and design; the record here shows which findings recurred, not why they were written

What Attestkeep produces

Evidence from records the cluster already keeps.

Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.

Statements the mapping draws on

Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.

Every decision and administrative action is recorded4 clauses
Only images of established provenance may run4 clauses
Workloads name images by digest, not by a movable tag2 clauses
Every image in the inventory carries a scan record2 clauses
Images carrying severe findings are refused2 clauses
Administrative access is federated to a directory1 clause
The control itself was operating throughout the period1 clause
Accepted risks are named, justified and expire1 clause
A refusal or a critical finding reaches a person1 clause
Images may enter only from named registries1 clause
Remediation windows are declared for each severity1 clause
A bill of materials is held for the images in service1 clause

The package

What the report contains.

Every package carries the same sections, whatever the framework. The ones marked are those NIST SSDF answers cite, with the number of clauses citing each.

The scope paragraph, as the report states it.

This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto the Secure Software Development Framework. SSDF governs how software is produced; a deployment-time control speaks to the practices that reach past the build — verifying the integrity and provenance of what is released, knowing which third-party components are in service, and finding and answering vulnerabilities in software already deployed. Practices about source code, design review, build toolchains and developer training belong to the producing organisation and are marked outside the scope of this document rather than stretched to fit.

Questions

About NIST SSDF and Attestkeep

Is this a NIST SSDF certification?

No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.

Why are 2 of the clauses outside scope?

They ask about things one cluster's admission and scanning records cannot show. They are listed with the reason rather than left out, so whoever reads the report can see the gap is deliberate.

Which plan includes NIST SSDF?

Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.

How does an auditor check the package?

In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account