# WYG NIST SSDF Baseline — Pilot

**Framework:** NIST SP 800-218, Secure Software Development Framework 1.1
**Status:** Risk-based alignment baseline; not a certification
**Updated:** August 23, 2026

NIST organizes SSDF practices into Prepare the Organization, Protect the Software, Produce Well-Secured Software, and Respond to Vulnerabilities. WYG uses those outcomes to structure a small-team pilot program.

| SSDF outcome | WYG pilot practice | Evidence / next gate |
|---|---|---|
| Prepare the Organization | Named product, privacy, security, incident, backup, and school-contact responsibilities | Complete owner/contact placeholders and quarterly review |
| Define security requirements | Student-data addendum, no-advertising/no-profiling rules, server-side answer keys, immutable testing evidence, RPO/RTO proposals | Counsel and district approval |
| Secure development environments | Individual accounts, MFA, least privilege, protected secrets, no production student data in development | Complete maintainer register and source-host settings |
| Protect software and releases | Exact dependency lock, immutable source versions, reviewed migrations, CI build/test/recovery gates | Require protected branch/review after approved source mirror |
| Produce well-secured software | Program-scoped authorization, hashed credentials/tokens, private files, validation, rate limiting, safe errors, security headers, automated tests | Threat review, external security review, mobile/load testing |
| Track components and vulnerabilities | Lockfile, weekly dependency checks, audit gate, Dependabot configuration, security reporting policy | Enable repository dependency graph, alerts, and security updates |
| Verify releases | Type, lint, product, build, recovery, and dependency checks; deployment tied to a source version | Retain evidence and require release approval |
| Respond to vulnerabilities | Private reporting channel, severity model, containment, school notice, remediation, root-cause review | Name response team and complete tabletop |

WYG will reassess this baseline after the pilot, new infrastructure providers, new student-data categories, significant security findings, or material product architecture changes. A control is not treated as complete merely because it appears in this matrix; activation and evidence gates still apply.