• Home
  • BVSSH
  • Engineering Enablement
  • Playbooks
  • Frameworks
  • Good Reads
Search

What are you looking for?

Standard : Security is considered from the start

Purpose and Strategic Importance

This standard ensures security is embedded from the outset-not bolted on later-by integrating threat modelling, secure design, and controls into early development stages. It reduces risk while supporting speed and scale.

Aligned to our "Secure by Design" policy, this standard builds resilience through foresight, not reaction. Without it, vulnerabilities emerge late, are costlier to fix, and erode user and stakeholder trust.

Strategic Impact

Clearly defined impacts of meeting this standard include improved delivery flow, reduced risk, higher system resilience, and better alignment to business needs. Over time, teams will see reduced rework, faster time to value, and stronger system integrity.

Risks of Not Having This Standard

  • Reduced ability to respond to change or failure
  • Accumulation of technical debt or friction
  • Poor developer experience and morale
  • Decreased confidence in releases and features
  • Misalignment between technical implementation and business priorities

CMMI Maturity Model

  • Level 1 – Initial: Security considerations are reactive or absent.

  • Level 2 – Managed: Security reviews occur, but only late in development.

  • Level 3 – Defined: Security requirements and threat modelling are embedded in early design phases.

  • Level 4 – Quantitatively Managed: Security posture is measured, and risks are actively prioritised.

  • Level 5 – Optimising: Security is treated as a design principle and continuously improved through proactive feedback loops.


Key Measures

  • Adoption metrics relevant to the standard (to be defined)
  • Quality, throughput, and system health metrics aligned to capability
  • Maturity scores based on structured assessment
Associated Policies
  • Secure by Design
Associated Practices
  • Configuration as Code
  • Immutable Infrastructure
  • Infrastructure Threat Detection
  • Linting and Static Code Analysis
  • Zero Trust Architecture
  • Security Testing in CI/CD
  • Identity Federation
  • Just-in-Time Access
  • Secret Rotation Automation
  • Software Composition Analysis (SCA)
  • Dynamic Application Security Testing (DAST)
  • Multi-Factor Authentication (MFA)
  • Secrets Management in Pipelines
  • Static Application Security Testing (SAST)
  • Shift-Left Testing
  • Test Coverage Analysis
  • Test Data Management
  • Bounded Context Mapping

Technical debt is like junk food - easy now, painful later.

Awesome Blogs
  • LinkedIn Engineering
  • Github Engineering
  • Uber Engineering
  • Code as Craft
  • Medium.engineering