NIST SSDF Phase 1 — Plan & Requirements

Phase label: nist-phase-1-plan

This skill files GitHub issues. It does not write code.

What this phase is about

Before code is written, the organization sets the conditions for secure development: the security requirements that software must meet, the people and roles accountable for meeting them, the toolchains that automate them, the criteria for checking them, and the protected environments in which development happens. NIST groups all of these under "Prepare the Organization" (PO).

Practices

Walk these in order — each one assumes the previous has landed. Read a practice's reference file only when you reach it, not up front.

How to run

Follow the phase walkthrough protocol in references/protocol.md. Substitutions:

• <PHASE_N> = 1
• <PHASE_NAME> = Plan & Requirements
• <PHASE_LABEL> = nist-phase-1-plan
• <PRACTICES> = PO.1, PO.2, PO.3, PO.4, PO.5

Phase epic title: [NIST Phase 1] Plan & Requirements.

The protocol confirms scope with the user, finds or creates the phase epic, then walks each practice — checking for an existing epic, asking whether to file, link, or skip, and updating the phase epic checklist as it goes. It never creates an issue without confirmation.

Adapting to the repo

The implementation notes in each reference file are deliberately generic, because this skill is meant to run against any repository. Before drafting an epic, look at what the repo actually has — CI workflows, package manifests, branch protection, existing security docs — and rewrite the notes to name real files and real gaps. An epic that says "branch protection on main has no required status checks" is worth more than one that says "configure branch protection".