Certified Organization for Development Excellence (CODE)

What Is CODE?

In addition to the organization-wide SDO designation, an organization can earn the designation of Certified Organization for Development Excellence (CODE). The concept of the CODE certification is to use a third-party conformity assessment of secure development practices rather than a count of certified personnel.

CODE certification is exclusive of an SDO designation. An organization does not have to be an SDO to seek or obtain CODE certification, and the two can be held together.

Certified Organization for Development Excellence (CODE)

CODE is the Secure Code Alliance's third-party conformity assessment of secure development practices. Where the SDO designation measures organizational commitment through certified headcount, CODE assesses the practices themselves against an external authority, and an organization can hold both.

Ideal for: software producers that must provide customers or federal buyers with independently assessed evidence of conformity rather than self-attestation alone.

What Does This Certification Cover?

• Third-party conformity assessment of secure development practices
• CODE 1: conformity with the CISA Secure Software Development Attestation Form (SSDAF)
• CODE 2: conformity with NIST SP 800-218, the Secure Software Development Framework
• The Cyber AB as the Accreditation Body for the SCA's organization-level scheme
• The SCF Conformity Assessment Program (SCF CAP) as the assessment methodology

How Conformity Is Assessed

CODE does not run its own assessment infrastructure. The SCA made two appointments that place the certification inside the same ecosystem the SCF already uses.