Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Measure carries four categories and twenty-two subcategories, and they divide cleanly by what kind of evidence satisfies them. Some ask whether something was observed. Others ask whether something was tested. Monitoring answers the first group and contributes almost nothing to the second.

One of the jobs of the National Institute of Standards and Technology is to keep on top of new technologies as they are developed and evolve. This is particularly important for risk management, considering both of the major governmental information security frameworks (FedRAMP and CMMC) are based on NIST publications. Well, as you might imagine, Artificial Intelligence technology is a huge new risk factor.

The NIST Secure Software Development Framework (SSDF) is a set of fundamental, outcome-based practices that integrate security throughout the software development lifecycle (SDLC). Documented in NIST SP 800-218, it helps organizations reduce vulnerabilities, prevent recurrences, and establish a common language for secure development. The SSDF outlines dozens of tasks grouped into four high-level categories.