Compare

SSDF SP 800-218 vs C-SCRM: how they differ, side by side

How SSDF SP 800-218 and C-SCRM differ: what each is, who owes it, when it applies and who enforces it.

SSDF SP 800-218Voluntary framework; no government-wide attestation since Jan 2026

C-SCRMGuidance for federal agencies; reaches suppliers through contracts

Checked21 Oct 2026

01 / Side by side

SSDF SP 800-218 and C-SCRM, side by side

	SSDF SP 800-218	C-SCRM
What it is	federal standard	guidance
Jurisdiction	United States (federal)	United States (federal)
Legal force	Voluntary framework; no government-wide attestation since Jan 2026	Guidance for federal agencies; reaches suppliers through contracts
Status	Published standard	Published standard
Applies from	3 Feb 2022	5 May 2022
Who owes it	Software producers of all kinds, and in particular vendors whose software is used by US federal agencies.	Federal agencies managing cybersecurity risk in the products and services they acquire, and by extension their suppliers; usable by any organization.
Enforcement	None directly; voluntary. Agencies may require SSDF practices or an attestation by contract, and false contract representations can create False Claims Act exposure.	None directly; applied through agency risk management under FISMA and through contract terms.

02 / SSDF SP 800-218

What SSDF SP 800-218 requires

SP 800-218A (July 2024) is an SSDF community profile for generative AI and dual-use foundation models; it adds tasks such as protecting training data and model weights and tracking model provenance.

01Define security requirements, roles, training and toolchains for software development (PO).
02Protect code, releases and provenance data from tampering and unauthorized access (PS).
03Design securely, review and test code, and configure software secure by default (PW).
04Identify, analyze and fix vulnerabilities and their root causes after release (RV).
05Apply practices on a risk basis and document how each is met.

03 / C-SCRM

What C-SCRM requires

Third-party models, training data, AI APIs and AI-enabled software are supply chain elements under this guidance. It contains no AI-specific controls.

01Set a C-SCRM strategy, policy and implementation plan at enterprise, mission and system levels.
02Assess supply chain risk for products and services before and during acquisition.
03Apply and tailor supply chain controls (SP 800-53 SR family and enhanced overlays) to systems.
04Flow C-SCRM requirements into supplier contracts and monitor supplier compliance.
05Maintain visibility into components, provenance and suppliers, and respond to supply chain incidents.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES