# NIST SP 800-218A (SSDF profile for generative AI): Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile (NIST SP 800-218A)

Source: https://www.bankingnewsai.com/ai-regulation/documents/nist-sp-800-218a
Last updated: Sep 17, 2026

NIST SP 800-218A, published on July 26, 2024, is a community profile of the Secure Software Development Framework (SSDF, SP 800-218 version 1.1) for generative AI and dual-use foundation models. It augments the SSDF's practices and tasks with recommendations, considerations, notes and informative references specific to AI model development across the software development life cycle, and is meant to be used together with SP 800-218 rather than in its place. Its stated audience is producers of AI models, producers of AI systems that use those models, and acquirers of those systems, which for a bank means both the teams building on foundation models and the functions that buy AI-enabled software. It was one of the July 2024 deliverables under Executive Order 14110, alongside the AI 600-1 Generative AI Profile, and remains a standing NIST publication.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [NIST](https://www.bankingnewsai.com/ai-regulation/nist) |
| Type | Framework |
| Status | In force |
| Published | Jul 26, 2024 |
| Effective | Jul 26, 2024 |
| Applies to | Voluntary; producers of AI models, producers of AI systems that use those models, and acquirers of those systems — for banks, the teams building on foundation models and the vendor-management and application-security functions that buy them |
| Official text | https://csrc.nist.gov/pubs/sp/800/218/a/final |

## Key points

- Published July 26, 2024 as a companion to SP 800-218 (SSDF v1.1); augments, does not replace, the SSDF's four practice groups — prepare the organization, protect the software, produce well-secured software, respond to vulnerabilities.
- Adds AI-specific practices, tasks, recommendations and informative references covering model development throughout the life cycle: training data provenance and integrity, model and weight protection, evaluation, and secure integration of models into systems.
- Written for three audiences: AI model producers, producers of systems that use AI models, and acquirers of those systems — so it is a procurement checklist as well as an engineering one.
- One of the Executive Order 14110 deliverables released with the AI 600-1 Generative AI Profile; the Order has since been revoked but the profile stands as a NIST publication.
- For banks it is the reference point when secure-development standards are extended to AI components and to code produced with AI assistance — the practice New York DFS asked regulated entities to put under human review in May 2026.

## What changed for banks

It gave application-security and vendor-management teams a NIST-numbered basis for extending the SSDF to AI model development and integration, at the moment regulators began asking how AI-generated and AI-integrated software is reviewed before deployment.

## Use cases it governs

- [AI-generated code & coding agents](https://www.bankingnewsai.com/ai-regulation/by-use-case#ai-generated-code)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)

## FAQ

### Does SP 800-218A replace the SSDF?

No. It is a community profile that augments SSDF version 1.1 with AI-specific content and is meant to be used in conjunction with SP 800-218.

### Who is SP 800-218A for?

Producers of AI models, producers of AI systems that use those models, and acquirers of those AI systems — in a bank, both the engineering teams building on foundation models and the functions that procure AI-enabled software.

## Related documents

- [AI RMF critical-infrastructure profile (concept note)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-rmf-critical-infrastructure-profile-concept-note) — Concept Note: AI RMF Profile on Trustworthy AI in Critical Infrastructure (Apr 7, 2026)
- [CAISI RFI on AI agent security (2026)](https://www.bankingnewsai.com/ai-regulation/documents/nist-caisi-rfi-ai-agent-security-2026) — Request for Information: Security Considerations for Artificial Intelligence Agents (Jan 12, 2026)
- [NIST IR 8596 (Cyber AI Profile)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ir-8596) — Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile), NIST IR 8596 — preliminary draft (Dec 16, 2025)
- [NIST COSAiS control overlays](https://www.bankingnewsai.com/ai-regulation/documents/nist-cosais-control-overlays) — Control Overlays for Securing AI Systems (COSAiS): SP 800-53 overlays for generative, predictive and agentic AI (Aug 14, 2025)
- [NIST AI 100-2e2025 (Adversarial ML)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-2e2025) — Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (NIST AI 100-2e2025) (Mar 24, 2025)
- [NIST AI 600-1 (Generative AI Profile)](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-600-1) — Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (Jul 26, 2024)
- [NIST AI RMF 1.0](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-100-1) — Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 (Jan 26, 2023)
- [NIST AI RMF Playbook](https://www.bankingnewsai.com/ai-regulation/documents/nist-ai-rmf-playbook) — AI Risk Management Framework Playbook (Jan 26, 2023)

Last reviewed Sep 17, 2026. Cite the official text (https://csrc.nist.gov/pubs/sp/800/218/a/final) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/nist-sp-800-218a
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (19 authorities, 166 documents) and AI-strategy profiles of the 100 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.