Training Tracks by Role and Risk
🌟 Objective
To define the minimum mandatory content to include in initial (onboarding) and continuous training, by functional profile and application risk level, in alignment with Chapter 01 - Risk Management.
📌 This matrix makes it possible to configure coherent training tracks on platforms such as an LMS, internal portals, the technical backlog or permission pipelines.
🧬 What a Training Track is
A training track is a set of mandatory or recommended content assigned to a member of staff or role, based on their technical role and on the risk of the application they take part in. These tracks make it possible to align knowledge with the specific security demands of the project.
📋 Base Matrix by Profile and Risk Level
| Role / Risk | L1 (low) | L2 (medium) | L3 (high) |
|---|---|---|---|
| Dev | Basic secure coding, dependencies | Lightweight threat modelling, SCA, secure PR | Formal threat modelling, secure architecture, labs on vulnerable apps |
| QA | Basic security testing | Acceptance criteria, lightweight fuzzing | Advanced fuzzing, validation of exceptions, SAST/DAST |
| PO | Minimum requirements, secure backlog | Risk classification, justified exceptions | Formal acceptance process, review with AppSec |
| DevOps | Secrets management, environment configuration | Secure integration in CI/CD, pipelines with scanners | SLSA, provenance, continuous alerts, hardening |
| AppSec | - | Base tools, internal policies | Technical deepening, coaching for teams, advanced threat modelling |
| Third parties | Organisation policy, support channels | Minimum requirements, secure PR template | Customised training, conditional access, formal record |
🛠️ How to apply
- Instantiate the matrix in:
- 🎓 Tracks in the learning management system (LMS)
- 📋 Onboarding checklists by role
- 📦 Tasks in the technical backlog (e.g.
formacao:secure-coding)
- Ensure:
- Explicit assignment by project and role
- Formal record of completion (LMS, ticket, signature)
- Regular updates in the face of new risks or technologies
✅ Good practices
- Incorporate the training tracks into the organisation's annual training plan
- Review the content based on lessons learnt from incidents
- Adjust the tracks based on feedback from champions and technical teams
- Link the tracks to permission profiles or access to environments
📎 Cross-references
| Document | Relevance |
|---|---|
01-catalogo-formativo.md | Defines the training topics by chapter |
10-checklist-onboarding.md | Uses this matrix as the basis for verification |
03-programa-champions.md | Champions help to maintain and adjust the tracks |
90-indicadores-metricas.md | Measures coverage of and adherence to the tracks |
🔒 This matrix operationalises the proportional application of the SbD-ToE, guaranteeing that every participant receives training appropriate to their role and to the risk involved.