Which statement most accurately describes the primary purpose of NIST SP 800-218, the Secure Software Development Framework?
AIt certifies individual developers as competent in secure coding before they may commit to a repository
BIt defines a mandatory sequence of SDLC phases that every software producer must follow in order
CIt provides a set of high-level secure development practices that can be integrated into any existing development methodologycheck_circle Correct
DIt supplies a scanning tool that automatically detects vulnerabilities in source code repositories
The SSDF is a methodology-agnostic set of secure development practices, not a lifecycle, tool, or certification. NIST SP 800-218 organises secure development into practice groups expressed as outcomes rather than prescriptive steps, so organisations can map them onto whatever development methodology they already use instead of adopting a new lifecycle.
Why A is wrong: The SSDF addresses organisational practices, not personal certification; it does not credential developers, so this confuses a framework of practices with a professional qualification.
Why B is wrong: The SSDF is methodology-agnostic and prescribes outcomes rather than a fixed phase order, so treating it as a mandatory linear lifecycle misreads its intent.
Why C is correct: The SSDF groups practices into preparing the organisation, protecting software, producing well-secured software and responding to vulnerabilities, expressed as outcomes that fit any methodology such as agile or waterfall.
Why D is wrong: The SSDF is a documented framework of practices, not software; it references activities like static analysis but does not itself scan code, so this mistakes guidance for tooling.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Because security controls added late still cost the same to implement as those planned early
errorWhy it is wrong: This reverses a core principle: defects and missing controls are markedly cheaper to address early, so the claim that cost is unchanged is exactly what the emphasis on early requirements refutes.
Running an authenticated dynamic application security test (DAST) against the staging environment each night
errorWhy it is wrong: Nightly DAST is a valuable runtime control, but it operates on running code in the testing phase, so it catches flaws long after the design decisions that create them and does not achieve the goal of acting before code is written.
Encoding the API keys in Base64 before committing them so they are not stored as readable plaintext.
errorWhy it is wrong: Tempting because it obscures the value, but Base64 is reversible encoding not protection, so the secret is still exposed in the repository.