Organisational Assets
Welcome to the central repository of organisational policies and implementation templates for the Security by Design – Theory of Everything (SbD-ToE) framework.
📌 What is found here
Organisational Policies
These are formal policies that legitimise, operationalise and audit the security practices described in the 14 chapters of the SbD-ToE Manual.
Why do policies matter?
- ✅ They make practices binding across the whole organisation
- ✅ They serve as the basis for internal and external audits
- ✅ They enable traceability of security decisions
- ✅ They ensure consistency across processes
Examples of available policies:
- 🎯 Risk Classification and Acceptance
- 📋 Security Requirements
- 🏗️ Secure Architecture
- 🔄 Secure CI/CD
- 📦 Dependency Management
- 🐳 Secure Containers
- 📊 Monitoring and Operations
- 🎓 Training and Onboarding
Each policy is reusable, adaptable to each organisation and aligned with standards such as ISO/IEC 27005, NIST SSDF, OWASP SAMM and CIS Controls.
🔗 Cross-Reference
The policies are mapped to the chapters of the Manual:
| Chapter | Recommended Policies |
|---|---|
| 1. Application Classification | Risk Classification, Periodic Review, Traceability |
| 2. Security Requirements | Security Requirements, Backlog Integration |
| 3. Threat Modelling | Threat Modelling, Model Validation |
| 4. Secure Architecture | Secure Architecture, Technical Design Approval |
| 5. Dependencies (SBOM/SCA) | Dependencies, SBOM, CVE Exceptions, Automatic Updates |
| 6. Secure Development | Development Guidelines, Code Review, GenAI |
| 7. Secure CI/CD | Secure CI/CD, Secrets Management |
| 8. IaC & Infrastructure | Secure IaC, Plan Approval |
| 9. Containers and Images | Secure Containers, Golden Base Images |
| 10. Security Testing | Testing Strategy, PenTesting |
| 11. Secure Deployment | Secure Deployment, Release Approval, Rollback |
| 12. Monitoring and Operations | Monitoring, Logging, Alerts, Incident Response |
| 13. Training and Onboarding | Security Training, Training KPIs |
| 14. Governance and Contracting | Secure Contracting, Governance, Organisational Traceability |
📂 Structure
020-assets/
├── intro.md (este ficheiro)
└── policies/
├── 01_policy-dast-fuzzing.md
├── 02_policy-classificacao-risco.md
├── 03_policy-aceitacao-risco.md
└── ... (mais 34 políticas)
🚀 How to Use
- Identify the chapter: Select which chapter of the SbD-ToE Manual is relevant to the initiative at hand
- Consult the corresponding policy: Each chapter points to the recommended policies
- Adapt to the organisation: Use the policies as a basis, tailoring them to the context
- Implement and audit: Ensure compliance through periodic audits
💡 Aligned Standards & Frameworks
The policies documented here are aligned with:
- 🔒 ISO/IEC 27005 – Information Security Risk Management
- 🛡️ NIST SSDF – Secure Software Development Framework
- 📋 OWASP SAMM – Software Assurance Maturity Model
- 🎯 CIS Controls v8 – Critical Security Controls
- 🌐 ENISA Risk Management – European Recommendations
📞 Support
For questions, contributions or feedback on these policies, consult:
- Manual Documentation: Security by Design – Complete Manual
- Repository: https://github.com/Shiftleftpt/SbD-ToE-Manual
Last updated: 30 March 2026