Secure Technical Onboarding Checklist
This checklist makes it possible to verify whether the onboarding process of a member of staff (internal or external) meets the minimum requirements defined in Chapter 13 - Training and Onboarding, in a way that is proportional to the risk and to the assigned role, and with formal traceability.
📌 It may be used by Dev Leads, AppSec, Champions, HR or project managers to ensure that the person is fit to intervene technically in the system.
📋 Items to validate (per member of staff)
| Item | Verified? |
|---|---|
| Assignment of the correct training track, based on the role and on the risk of the application | ☐ |
| Completion of the training track (videos, labs, synchronous sessions, guided reading) | ☐ |
| Knowledge validation (quiz, practical exercise or simulation) successfully carried out | ☐ |
| Participation in or submission of a real or simulated PR with a security focus (e.g. guided review) | ☐ |
| Access to the repository of good practices, templates, policies and tools confirmed | ☐ |
| Technical access (Git, pipelines, environments) conditional on completion of the process | ☐ |
| Formal record of completion archived (SharePoint, LMS, Git, issue tracker or form) | ☐ |
| Support contact identified (e.g. SPOC, Champion, Teams/Slack channel or reference document) | ☐ |
🧭 Application notes
- Applicable to Dev, QA, DevOps, AppSec profiles and to third parties with access to systems or pipelines
- Must be carried out before any significant technical activity
- May be formalised as:
- A form in the onboarding system (HR)
- An issue or task in the technical backlog
- An automatic record in the LMS or in the permissions system (RBAC)
- A periodic review of the track per role is recommended, especially after updates to the SbD-ToE Manual
🔗 Cross-references
| Document | Role |
|---|---|
trilho-formativo.md | Matrix of tracks by profile and risk |
90-catalogo-formativo.md | List of content to teach per chapter and role |
manual-formacao-por-perfil.md | Suggested training modules per role |
02-formacao-onboarding.md | Description of the onboarding objectives and flow |
🔐 Access to critical systems must be conditional on the formal verification of this checklist, ensuring that all members of staff have been adequately trained and prepared.