A tailored course, built for your situation
Direct sign-off authority on NIST SSDF implementation choices
Make the call on secure software development frameworks without escalation
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Frustration from waiting on approvals slows secure software delivery
The situation this course is for
Teams stall when security frameworks require layered approvals. Practitioners who can't decide independently delay momentum and dilute accountability.
Who this is for
Security-savvy talent or operations lead in a tech-forward organisation, positioned to influence secure development practice but lacking formal decision rights on frameworks
Who this is not for
Framework auditors, compliance checkers, or individual contributors not involved in cross-functional policy decisions
What you walk away with
- Own final decisions on which NIST SSDF controls apply to your environment
- Set thresholds for maturity assessment without escalation
- Choose integration sequence for development tooling and CI/CD pipelines
- Tailor documentation requirements for internal and external reviewers
- Lead framework adoption without requiring senior sign-off on standard choices
The 12 modules (with all 144 chapters)
Module 1. Defining your NIST SSDF scope
Establish the boundaries of your implementation. Decide which development teams, products, and pipelines fall under the framework.
12 chapters in this module
- Mapping team ownership
- Identifying covered products
- Setting rollout phases
- Excluding non-core systems
- Documenting scope rationale
- Aligning with engineering leads
- Capturing exceptions
- Updating scope over time
- Versioning scope documents
- Integrating with onboarding
- Tracking scope changes
- Communicating scope decisions
Module 2. Selecting mandatory controls
Choose which NIST SSDF controls are required by default. Make binding decisions on applicability.
12 chapters in this module
- Reviewing control list
- Classifying control impact
- Setting default inclusions
- Documenting control rationale
- Creating control exemptions
- Updating control lists
- Versioning control sets
- Sharing control decisions
- Integrating with tooling
- Auditing control compliance
- Revising controls quarterly
- Reporting control status
Module 3. Setting maturity levels
Define what 'met' means for each control. Set scoring rules and evidence expectations.
12 chapters in this module
- Choosing scoring method
- Defining evidence types
- Setting pass thresholds
- Creating scoring rubrics
- Applying maturity tiers
- Adjusting for team size
- Documenting scoring rules
- Versioning scoring guides
- Training assessors
- Auditing maturity claims
- Updating scoring annually
- Reporting maturity trends
Module 4. Controlling integration sequence
Decide the order in which teams adopt NIST SSDF. Sequence by risk, maturity, or product line.
12 chapters in this module
- Identifying high-risk teams
- Assessing readiness
- Setting rollout order
- Creating onboarding plan
- Tracking adoption progress
- Adjusting sequence
- Managing exceptions
- Documenting decisions
- Versioning rollout plan
- Aligning with product roadmap
- Communicating sequence
- Updating plan quarterly
Module 5. Owning documentation standards
Set expectations for internal and external documentation. Decide what gets recorded and how.
12 chapters in this module
- Choosing template formats
- Setting detail levels
- Defining review cycles
- Assigning authors
- Approving final drafts
- Storing documents
- Updating versions
- Archiving old versions
- Sharing with auditors
- Responding to requests
- Training document owners
- Auditing compliance
Module 6. Managing tooling integration
Decide which tools enforce NIST SSDF. Own the mapping between controls and technical enforcement.
12 chapters in this module
- Inventorying tools
- Matching tools to controls
- Setting integration rules
- Approving automation
- Testing enforcement
- Documenting mappings
- Updating integrations
- Retiring outdated tools
- Versioning tool maps
- Training teams
- Auditing tool coverage
- Reporting gaps
Module 7. Leading cross-functional adoption
Drive implementation across teams. Resolve conflicts and set precedents.
12 chapters in this module
- Creating rollout calendar
- Running kickoff sessions
- Assigning leads
- Tracking progress
- Resolving disputes
- Setting escalation paths
- Documenting decisions
- Updating leadership
- Celebrating milestones
- Adjusting plans
- Sharing best practices
- Auditing adoption
Module 8. Setting review cycles
Decide how often controls are reassessed. Own the rhythm of compliance checks.
12 chapters in this module
- Choosing frequency
- Aligning with audits
- Scheduling reviews
- Assigning reviewers
- Setting reminders
- Tracking completion
- Updating schedules
- Managing exceptions
- Documenting cycles
- Versioning calendar
- Communicating dates
- Auditing review compliance
Module 9. Handling exceptions and waivers
Decide when deviations are allowed. Set policy and process for approvals.
12 chapters in this module
- Defining exception types
- Setting approval rules
- Creating request forms
- Reviewing submissions
- Approving waivers
- Setting expiration dates
- Tracking active waivers
- Notifying stakeholders
- Updating policies
- Auditing waiver use
- Reporting trends
- Revising thresholds
Module 10. Owning audit responses
Lead responses to internal and external auditors. Control what evidence is shared and how it's framed.
12 chapters in this module
- Receiving audit requests
- Assigning response leads
- Reviewing evidence
- Approving responses
- Setting response tone
- Documenting decisions
- Versioning submissions
- Storing responses
- Updating based on feedback
- Training responders
- Auditing quality
- Reporting outcomes
Module 11. Updating framework decisions
Own changes to the framework over time. Decide when revisions are needed.
12 chapters in this module
- Monitoring changes
- Proposing updates
- Reviewing proposals
- Approving changes
- Setting implementation dates
- Communicating updates
- Training teams
- Phasing transitions
- Documenting decisions
- Versioning framework
- Auditing adoption
- Reporting impact
Module 12. Sustaining decision authority
Protect and extend your role as the decision-maker. Build recognition and trust.
12 chapters in this module
- Tracking decisions
- Measuring impact
- Sharing outcomes
- Building credibility
- Defending authority
- Onboarding successors
- Updating playbooks
- Scaling influence
- Responding to challenges
- Maintaining standards
- Auditing consistency
- Extending to other frameworks
How this maps to your situation
- When leading rollout of NIST SSDF in engineering teams
- When responding to compliance audit findings
- When integrating security into CI/CD pipelines
- When scaling secure development across product lines
Before vs. after
Before
Waiting for approval on framework decisions, slowing secure delivery and diluting accountability
After
Making final calls on NIST SSDF implementation, accelerating adoption and strengthening leadership position
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, with flexible pacing to fit your schedule.
If nothing changes
Continuing to defer framework decisions creates delays, erodes trust in your leadership, and weakens your influence on secure software delivery.
How this compares to the alternatives
Unlike generic compliance courses, this program focuses on decision authority, giving you concrete tools to own NIST SSDF implementation, not just understand it.
Frequently asked
Who is this course for?
Practitioners in tech organisations who are positioned to lead secure software frameworks but lack formal decision rights on implementation.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Does this cover other frameworks?
Focus is on NIST SSDF. The decision-making structure can be applied to other frameworks, but content is specific to NIST SSDF.
$199 one-time. Approximately 3 hours per module, with flexible pacing to fit your schedule..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours