Manual Index SbD-ToE
The SbD-ToE Manual is organised into 14 chapters that cover the entire secure development lifecycle, from the initial classification to ongoing operation and governance.
Application Classification
🧱FoundationalCriticality criteria (exposure, data, impact) for proportional controls and traceability
Open chapter →Security Requirements
🧱FoundationalPrescriptive catalogue and validations by risk level, aligned with DSOMM/SSDF/SAMM
Open chapter →Threat Modelling
🧱FoundationalIdentification of threats and abuse scenarios with STRIDE/LINDDUN, linked to requirements and tests
Open chapter →Secure Architecture
🧱FoundationalArchitecture patterns and decisions (ADR) aligned with risks and requirements
Open chapter →Dependencies, SBOM and SCA
⚙️OperationalComponent management, SBOM and SCA with governed and traceable exceptions
Open chapter →Secure Development
⚙️OperationalSecure coding practices, code reviews and validations in the workflow
Open chapter →Secure CI/CD
⚙️OperationalPipeline as a product: isolation, signatures, promotions and end-to-end integrity
Open chapter →Infrastructure as Code (IaC)
⚙️OperationalApplying SbD to infrastructure and environments with traceable automation
Open chapter →Containers and Images
⚙️OperationalHardening, trusted registries, publication policy and secure execution
Open chapter →Security Testing
⚙️OperationalL1–L3 verification strategy: SAST, DAST, IAST, fuzzing, semantic analysis
Open chapter →Secure Deployment
⚙️OperationalControlled releases, reversibility, feature flags and security evidence
Open chapter →Monitoring and Operations
⚙️OperationalObservability, detection/alerting, response playbooks and post-deployment coverage
Open chapter →Training and Onboarding
🏛️OrganisationalContinuous upskilling by role, secure coding dojos and training tracks
Open chapter →Governance and Contracting
🏛️OrganisationalGovernance models, KPIs, contractual clauses and supplier validation
Open chapter →