Industry reference
Software quality extends from requirements and development controls to release, updates and vulnerability response. NIST and CISA guidance provides a technical framework; sector rules and procurement instruments determine any additional binding obligations.
A product-specific review
Define the software, firmware, dependencies, services and supported versions. Identify functions that affect safety, security or regulatory performance. Sector rules and procurement conditions can create obligations beyond the general secure development guidance published by NIST and CISA.
Connect requirements, architecture, code review, testing and release evidence to the delivered version. Review third-party component identity and known vulnerabilities. A security pledge or a completed scan is one piece of evidence, rather than proof that all security risks have been resolved.
Maintain update, vulnerability intake and correction arrangements through the supported life. Review firmware changes for their effect on radio, energy or protective functions where relevant. Guidance remains distinct from any binding sector requirement or contractually adopted attestation condition.
2 source profiles
Review the references relevant to your product and activity. This selected federal collection does not replace a separate review of applicable state, local or contractual requirements.
Agency guidanceCISA
CISA Secure by Design guidance
CISA’s Secure by Design work addresses the responsibilities of technology manufacturers in reducing security risks for customers. It emphasizes product design, secure defaults and organizational accountability. The guidance is useful for product quality reviews because many security failures originate in design and support decisions that cannot be resolved by an end user’s configuration alone.
Agency guidanceNIST
NIST SP 800-218, SSDF Version 1.1
The Secure Software Development Framework provides practices for integrating security into software development. SP 800-218, Version 1.1, is identified here by its final publication designation. Organizations can use the framework to organize responsibilities, protect development assets, produce well-secured software and respond to vulnerabilities, while assessing any procurement obligations through the applicable contract or program.
Identify the product configuration, the controlling provision and edition, the evidence required and the person authorized to make the decision. Keep a reason for exclusions and unresolved questions alongside confirmed requirements.
Revisit the record when design, materials, suppliers, software, claims or the applicable source changes. An earlier report remains useful only to the extent that it supports the current configuration and requirement.
Practice guide
A structured impact review across requirements, test evidence, suppliers, labels and released configurations.
Read the guidePractice guide
Request evidence that matches the supplied product, applicable requirements and change responsibilities.
Read the guide