Secure Software Development Framework (SSDF) Version 1.1
Joint Task Force (2020) Security and Privacy Controls for Information

Internal Report (IR) 7692. https://doi.org/10.6028/NIST.IR.7692

LeMay E, Scarfone KA, Mell PM (2012) The Common Misuse Scoring

System (CMSS): Metrics for Software Feature Misuse Vulnerabilities.
Interagency or Internal Report (IR) 7864.

Black P, Guttman B, Okun V (2021) Guidelines on Minimum Standards

for Developer Verification of Software. (National Institute of Standards

and Technology, Gaithersburg, MD), NIST Interagency or Internal Report

(IR) 8397. https://doi.org/10.6028/NIST.IR.8397

International Organization for Standardization (ISO)/International

Electrotechnical Commission (IEC), Information technology - Security

techniques - Application security - Part 1: Overview and concepts,

ISO/IEC 27034-1:2011, 2011. Available at

International Organization for Standardization (ISO)/International

Electrotechnical Commission (IEC), Information technology - Security

techniques - Vulnerability disclosure, ISO/IEC 29147:2018, 2018.

Available at https://www.iso.org/standard/72311.html

International Organization for Standardization (ISO)/International

Electrotechnical Commission (IEC), Information technology - Security

techniques - Vulnerability handling processes, ISO/IEC 30111:2019, 2019.

Available at https://www.iso.org/standard/69725.html

Microsoft (2021) Security Development Lifecycle. Available at

https://www.microsoft.com/en-us/securityengineering/sdl/

Improving Critical Infrastructure Cybersecurity, Version 1.1. (National

Institute of Standards and Technology, Gaithersburg, MD).

[NISTLABEL]

Ogata M, Haney J, Merkel W, Phelps A (2022) Recommended Criteria for
Cybersecurity Labeling of Consumer Software. (National Institute of

Standards and Technology, Gaithersburg, MD). Available at

https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity

National Telecommunications and Information Administration (NTIA)

(2021) The Minimum Elements For a Software Bill of Materials (SBOM).

Available at https://www.ntia.doc.gov/report/2021/minimum-elements-

Open Web Application Security Project (2021) OWASP Application

Security Verification Standard 4.0.3. Available at

[OWASPMASVS] Open Web Application Security Project (2021) OWASP Mobile

Application Security Verification Standard, Version 1.4.2. Available at

https://github.com/OWASP/owasp-masvs/releases

Open Web Application Security Project (2017) Software Assurance

Maturity Model Version 1.5. Available at

https://www.owasp.org/index.php/OWASP_SAMM_Project

Open Web Application Security Project (2020) OWASP Software

Component Verification Standard, Version 1.0. Available at

https://github.com/OWASP/Software-Component-Verification-Standard

Payment Card Industry (PCI) Security Standards Council (2021) Secure

Software Lifecycle (Secure SLC) Requirements and Assessment Procedures

https://www.pcisecuritystandards.org/document_library?category=sware_s

Software Assurance Forum for Excellence in Code (2012) Practical

Security Stories and Security Tasks for Agile Development Environments.

http://www.safecode.org/publication/SAFECode_Agile_Dev_Security0712

Software Assurance Forum for Excellence in Code (2018) Fundamental

Practices for Secure Software Development: Essential Elements of a

Secure Development Lifecycle Program, Third Edition. Available at

content/uploads/2018/03/SAFECode_Fundamental_Practices_for_Secure_

Software Assurance Forum for Excellence in Code (2010) Software

Integrity Controls: An Assurance-Based Approach to Minimizing Risks in

http://www.safecode.org/publication/SAFECode_Software_Integrity_Cont

Software Assurance Forum for Excellence in Code (2017) Managing

Security Risks Inherent in the Use of Third-Party Components. Available

content/uploads/2017/05/SAFECode_TPC_Whitepaper.pdf

Software Assurance Forum for Excellence in Code (2017) Tactical Threat

Modeling. Available at https://www.safecode.org/wp-

content/uploads/2017/05/SAFECode_TM_Whitepaper.pdf

Joint Task Force (2020) Security and Privacy Controls for Information

Systems and Organizations. (National Institute of Standards and
Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-53,
Rev. 5. Includes updates as of December 10, 2020.