Used before Security objectives agreed, to confirm the work of Security Objectives & Asset Identification is done, its work products are at the right maturity and its decisions are recorded. Run by the stage leads and checked by the product security owner.
MustDone: name the product security owner and the review board.
the person accountable for residual risk, the reviewers for architecture, design and release, and who may approve waivers. Without a named owner, risk acceptance drifts to whoever is under schedule pressure.
MustDone: adopt a secure development lifecycle.
map the company process to the public frameworks the target markets expect, such as IEC 62443 for industrial customers, ISO/SAE 21434 for vehicles and the NIST Secure Software Development Framework for software parts, and record which activities and records each stage owes.
MustDone: collect market security expectations.
customer security questionnaires, requests for certification, regulation in each target market such as the EU Cyber Resilience Act and radio equipment security rules, and export control regimes that apply to cryptography.
MustDone: identify the assets.
walk the product concept, the draft architecture and the software scope with architects and product managers, and list every key, secret, identity, image and configuration item with its owner and required property.
MustDone: set the assurance level and attacker scope at a first level of detail.
whether the product must resist only remote and software attacks, local and simple physical attacks, or laboratory attacks of the kind secure element markets expect.
31 more items for registered members.
The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.