NIST SSDF Phase 2 — Design

Phase label: nist-phase-2-design

This skill files GitHub issues. It does not write code.

What this phase is about

Design is where security is cheapest to add and most expensive to skip. In this phase the team uses risk modeling to predict how the software will be attacked, has those models reviewed by someone who did not draw them, and decides which security functions to reuse from already-vetted components rather than build from scratch.

Practices

Walk these in order — each one assumes the previous has landed. Read a practice's reference file only when you reach it, not up front.

How to run

Follow the phase walkthrough protocol in references/protocol.md. Substitutions:

• <PHASE_N> = 2
• <PHASE_NAME> = Design
• <PHASE_LABEL> = nist-phase-2-design
• <PRACTICES> = PW.1, PW.2, PW.4

Phase epic title: [NIST Phase 2] Design.

The protocol confirms scope with the user, finds or creates the phase epic, then walks each practice — checking for an existing epic, asking whether to file, link, or skip, and updating the phase epic checklist as it goes. It never creates an issue without confirmation.

Adapting to the repo

The implementation notes in each reference file are deliberately generic, because this skill is meant to run against any repository. Before drafting an epic, look at the actual architecture — where the trust boundaries are, which components handle untrusted input, what is already documented — and rewrite the notes to name real surfaces and real gaps. A threat-modeling task that names this system's actual attack surface is worth more than one that says "run a threat model".

Note on practice numbering

PW.4 has tasks PW.4.1, PW.4.2, and PW.4.4. There is no PW.4.3 — in SSDF v1.1 it moved to PW.1.3. The reference files preserve NIST's numbering; do not renumber them to close the gap.