Skip to content
Information SecurityUnited States

NIST SP 800-218A

What is NIST SP 800-218A?

NIST's SSDF Community Profile for AI model development: the secure software development tasks that matter most for generative AI and dual-use foundation models, with AI-specific recommendations on environments, protection of weights and training data, provenance, data analysis for poisoning, adversarial testing, model scanning, input and output monitoring, and stopping or rolling back a compromised model. It comprises 37 controls organised across 4 domains, and applies in the United States.

Map this against the frameworks you already hold

The compliance knowledge graph holds cross-framework control mappings for hundreds of standards, including the ones you are likely to be certified against already.

Browse the framework graph →

Where NIST SP 800-218A overlaps with the standards you already hold

NIST SP 800-218A vs ISO 27001:2022View comparison →NIST SP 800-218A vs SOC 2View comparison →NIST SP 800-218A vs NIST CSF 2.0View comparison →NIST SP 800-218A vs GDPRView comparison →NIST SP 800-218A vs HIPAAView comparison →NIST SP 800-218A vs PCI DSS 4.0View comparison →

What NIST SP 800-218A means in your sector

NIST SP 800-218A for Healthcare→NIST SP 800-218A for Financial Services→NIST SP 800-218A for Technology→NIST SP 800-218A for Government→NIST SP 800-218A for Manufacturing→NIST SP 800-218A for Energy→NIST SP 800-218A for Retail→NIST SP 800-218A for Education→

What NIST SP 800-218A means for your job

NIST SP 800-218A for CISOs→NIST SP 800-218A for Compliance Officers→NIST SP 800-218A for Risk Managers→NIST SP 800-218A for IT Directors→NIST SP 800-218A for DPOs→NIST SP 800-218A for Auditors→

Questions people ask about NIST SP 800-218A

What is NIST SP 800-218A?
NIST's SSDF Community Profile for AI model development: the secure software development tasks that matter most for generative AI and dual-use foundation models, with AI-specific recommendations on environments, protection of weights and training data, provenance, data analysis for poisoning, adversarial testing, model scanning, input and output monitoring, and stopping or rolling back a compromised model.
How many controls does NIST SP 800-218A have?
NIST SP 800-218A contains 37 controls organized across 4 domains.
Where does NIST SP 800-218A apply?
NIST SP 800-218A applies in United States. Organizations operating in or serving customers in this jurisdiction should check whether its requirements reach them.
Which version of NIST SP 800-218A is covered here?
This page covers NIST SP 800-218A (July 2024).

Query NIST SP 800-218A programmatically

NIST SP 800-218A, its 37 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.

NIST SP 800-218A API reference and MCP config →

How ready are you for NIST SP 800-218A?

Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.

Get Your Readiness Report, from $49Explore Platform Free
Written and maintained by Gerard Blokdyk, The Art of Service.Last updated .