Which statement most accurately describes the primary purpose of NIST SP 800-218, the Secure Software Development Framework?
- AIt certifies individual developers as competent in secure coding before they may commit to a repository
- BIt defines a mandatory sequence of SDLC phases that every software producer must follow in order
- CIt provides a set of high-level secure development practices that can be integrated into any existing development methodology Correct
- DIt supplies a scanning tool that automatically detects vulnerabilities in source code repositories
Why A is wrong: The SSDF addresses organisational practices, not personal certification; it does not credential developers, so this confuses a framework of practices with a professional qualification.
Why B is wrong: The SSDF is methodology-agnostic and prescribes outcomes rather than a fixed phase order, so treating it as a mandatory linear lifecycle misreads its intent.
Why C is correct: The SSDF groups practices into preparing the organisation, protecting software, producing well-secured software and responding to vulnerabilities, expressed as outcomes that fit any methodology such as agile or waterfall.
Why D is wrong: The SSDF is a documented framework of practices, not software; it references activities like static analysis but does not itself scan code, so this mistakes guidance for tooling.