About the SbD-ToE Project
What It Is
Security by Design - Theory of Everything (SbD-ToE) is a practical and prescriptive manual for integrating security into software development, from architecture through to operation.
SbD-ToE connects:
- Regulations with a published cross-check (NIS2, DORA, CRA, AI Act, GDPR, CSA) and standards used as reference (ISO 27001, ISO 27034)
- Maturity frameworks (SAMM, BSIMM)
- Real threats (MITRE ATT&CK, CWE, incidents)
- Software engineering (SDLC, DevOps, testing)
All of this in a coherent framework, proportional to risk and reusable.
Why It Exists
Software security is fragmented. Each organisation speaks different languages:
- Some speak compliance and regulation
- Others speak maturity and models
- Others speak threats and incidents
- Others speak development and engineering
Nobody integrates it all.
SbD-ToE fills that gap with a unified model that:
✅ Is not generic — Proportional to risk (L1, L2, L3)
✅ Is not theoretical — Practical, with examples and templates
✅ Is not overly prescriptive — Flexible and adaptable
✅ Does not duplicate — Each practice is traceable to its origin (standard, threat, etc.)
Structure
The project is organised into:
- Theory of Everything — The philosophy and foundations
- Ch. 00 — Fundamentals — How to use this manual
- Technical Manual (Ch. 01–14) — Prescriptive content
- Normative Cross-check — Alignment with regulations
Who Is Behind It
SbD-ToE is the result of:
- More than a decade of practice in operational security
- Security communities (OWASP, MITRE, ENISA)
- Continuous feedback from real teams and organisations
- Evolution based on incidents and lessons learned
It is an initiative of ShiftLeft and is open to the community.
How to Collaborate
The project is open-source and versioned in Git.
Contributions are welcome in the form of:
- 🐛 Bug reports — Found an error? Open an issue
- 📝 Improvements — Suggestions for clarity, completeness, etc.
- ✨ New content — Examples, templates, case studies
- 🌍 Translations — Help expand it into other languages
Licensing
The content of this manual is made available under:
- Documentation: Creative Commons BY-SA 4.0
- Example code: MIT License
See the Full Licence for details.
How to Get Started
- New to SbD-ToE? → Read Theory of Everything
- Want to use this manual? → Read Ch. 00 — How to Use
- Implementing security? → Go to the Technical Manual
- Checking compliance? → Consult the Normative Cross-check
Contact
Questions, suggestions or partnerships?
📧 Email: contato@shiftleft.pt
🐦 GitHub Issues: open an issue
💬 Discussions: GitHub Discussions
Welcome to SbD-ToE. Security by design, from the very start.