Skip to main content
Capítulo Organizacional

This chapter is considered organisational in the Security by Design - Theory of Everything (SbD-ToE) model. Its function is to ensure the adoption, governance and sustainable evolution of the security practices defined in the foundational and operational chapters.

The organisational chapters establish the human and procedural structure that makes it possible to consolidate the SbD-ToE in the organisation. Without these elements, security by design becomes ad hoc and dependent on individuals, losing the organisational consistency and resilience needed for long-term maturity.

Training and Upskilling

Security training is the link that turns technical prescriptions into operational practice, for example:

  • Ch. 12 - Monitoring and Operations guarantees visibility at runtime, but depends on trained teams to interpret alerts and react.
  • Ch. 14 - Governance and Contracting defines organisational commitments, but is only effective if the teams have the knowledge to meet them.

To ensure that "security is lived and breathed" and is part of the organisation's DNA, it is essential to cultivate that body. This chapter defines how Security becomes something intrinsic to the organisation through:

  • Onboarding programmes for new members.
  • Continuous training for Dev, QA, DevOps, AppSec, Management.
  • Security champions programmes.
  • Practical exercises (labs, CTFs, simulations).
  • Training effectiveness KPIs.
  • Integration into backlog and individual development plans.

👉 What makes this chapter exceptional is that it places people as the vector of resilience: an organisation may have secure pipelines and defined requirements, but if the engineers, testers, DevOps or managers have no training, security, in practice, degrades.

The extensive use of automated tools throughout the lifecycle does not reduce the need for human understanding of the processes, their limits and the associated responsibilities.

The training defined in this chapter ensures that all the parties involved understand how the adopted operating model really works, regardless of the degree of automation in place.

🧪 2. Practical prescription​

  • What to do: continuous training plan, onboarding with security, labs, effectiveness metrics.
  • How: LMS with training tracks per profile, champions per team, periodic reviews.
  • When: initial onboarding, quarterly cycles, whenever new controls are introduced.
  • Why: reduce human error, create a security culture, meet regulatory requirements.

👥 Roles involved​

  • Developer → receive practical training in SAST, dependencies, IaC.
  • QA → upskilling in fuzzing, regressions, validation.
  • AppSec Engineer → produce content, deliver training, manage champions.
  • DevOps / SRE → upskilling in secure pipelines and monitoring.
  • Executive Management → training in risk acceptance and governance.
  • HR / People Operations → manage the LMS, onboarding and individual plans.
  • Security Champion → evangelise and support teams.
  • Suppliers / Third Parties → suppliers with access must receive minimum training.

🔗 Integration in the cycle​

Upskilling must be present throughout the cycle:

  • Planning: definition of training requirements for each profile.
  • Development: labs and specific tracks integrated into the backlog.
  • Testing/Release: validation exercises linked to secure practices.
  • Operations: incident simulations for response training.
  • Audit: collection of effectiveness metrics (KPIs, internal audits).

👉 In this way, training stops being an “extra” and becomes an intrinsic part of the SDLC.

📊 Organisational traceability​

  • Upskilling KPIs: completion rate, knowledge retention, practical application in audits.
  • Effectiveness metrics: reduction of repeated findings in code, decrease in incidents attributed to human error.
  • Governance: periodic reports to GRC and integration into individual performance objectives.
  • Compliance: direct mapping to SSDF PO.3/PO.7 and SAMM PO2/PO3, guaranteeing normative coverage.

🏁 Conclusion​

Training is what turns processes into culture.

  • Without secure onboarding, the organisation accumulates basic failures.
  • Without continuous training, practices become obsolete.
  • Without champions, teams are left without security leadership.
  • Without metrics, there is no continuous improvement.

👉 That is why this chapter is considered foundational: it is here that it is guaranteed that the SbD-ToE is not merely documentation, but living practice.

📜 Relevant Organisational Policies​

PolicyMandatory?ApplicationMinimum content
Security Training and Upskilling PolicyYesHR / People Operations + AppSec EngineerAnnual plan, LMS, periodic review
Security Training and Upskilling Policy — OnboardingYesHR / People Operations + Executive ManagementMandatory training at the start
Training and Upskilling Policy — Security ChampionsRecommendedAppSec Engineer + DeveloperFormal programme with clear roles
Security Governance KPIs PolicyYesGRC / ComplianceKPIs, effectiveness, audit reports
Training and Upskilling Policy — Practical ExercisesRecommendedAppSec Engineer + QA + DeveloperLabs, CTFs, simulations

In the printed version, consult the Manual's Organisational Policies Annex, where these policies are consolidated on a cross-cutting basis.