The NIST National Cybersecurity Center of Excellence (NCCoE) is releasing this live document as part of its Secure Software Development, Security, and Operations (DevSecOps) project. This project demonstrates how organizations can implement the security practices and tasks recommended in the NIST Secure Software Development Framework (SSDF) using modern DevSecOps pipelines and commercially available technology. The live document is open for public comment until April 24, 2026.
This release provides several components of the NCCoE DevSecOps demonstration, including:
The live document shares findings from the NCCoE's collaborative, demonstrative applied research project with 14 technology companies, who contributed technologies, expertise, and operational insights. This project demonstrates and documents practical approaches for integrating SSDF practices into modern DevSecOps pipelines using commercially available technologies. By automating and standardizing security considerations throughout the development lifecycle, the project aims to help organizations improve efficiency, strengthen software supply chain security, and provide greater assurance that secure software development practices are consistently applied.
As part of NIST’s response to Executive Order (EO) 14306, Sustaining Select Efforts to Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144, this project will showcase examples of secure software development practices that fundamentally bolster the security of DevSecOps practices by implementing the SSDF's recommendations.
Unlike traditional static publications, this live document will be updated on a rolling basis with additional implementations and technical findings as the work with collaborators in the laboratory continues. In the coming months, the NCCoE will publish use case scenarios for the initial example implementation, as well as details on other example implementations showcasing several development platforms and tools. The NCCoE will also release an analysis that decomposes NIST SSDF practices and tasks into more granular and actionable tasks, illustrating their application within the project's DevSecOps model.
The Initial Public Draft of SP 1347, NIST Cybersecurity Framework 2.0: Informative References Quick‑Start Guide, explains what informative references are and how they support achieving the outcomes of the NIST Cybersecurity Framework (CSF) 2.0. The guide also introduces readers to NIST tools available for accessing, viewing, and using informative references for cybersecurity risk management, including direct download, the CSF 2.0 Reference Tool, and the Online Informative References Program. The draft contains two sample use cases and provides an overview of how artificial intelligence tools can support reference data use.
Today, the NCCoE published technical resources to help financial institutions use mobile driver’s licenses (mDLs) for customer identification. NIST Special Publication 1800-42 ipd provides an updated reference architecture, implementation details, and key findings from the project.
Compared to physical driver’s licenses, mobile driver’s licenses (mDLs) are easier to use for digital transactions and offer improved protections against fraud, identity theft, and unauthorized access. The NCCoE’s technology demonstration is tackling the security, privacy, and interoperability issues with mDLs.
This publication reflects insights from industry collaborators and lessons learned by developing a functional online demonstration using mDLs for customer identification. The publication provides a practical roadmap to enable adoption and implementation of mDLs for online financial management.
\nYou can improve this guide by contributing feedback. As an initial public draft, this document intends to gain critical feedback from stakeholders across government and industry on the implementation of mDL to support Customer Identification Programs and high assurance use cases more broadly. Comments are welcome on all aspects of this document and specifically encouraged on the following areas:
\n