Skip to main content

Advanced Recommendations - Training and Secure Onboarding

This document presents advanced recommendations that complement the minimum practices described in Chapter 13, applicable to organisations with greater security maturity, a consolidated DevSecOps culture and a focus on the scale, automation and continuous improvement of technical security training.

🔍 These practices make it possible to reach the high maturity levels defined by SAMM EDU.3, SSDF PO.4 and DSOMM Training & Awareness L4.

🚀 Recommendations for organisations with greater maturity​

🧠 1. Integration with an LMS platform​

  • Automate personalised training tracks per technical profile (Dev, QA, DevOps, AppSec).
  • Integrate quizzes, videos, practical tests and automated recording per chapter (e.g. Ch. 05 - SBOM).
  • Generate real-time dashboards per team, project or functional domain.
  • Version the content per SbD-ToE chapter and associate completion metrics.

🤖 2. Automatic validation via CI/CD​

  • Automatically validate that training and validation have been completed before authorising:
    • Access to repositories
    • Execution of pipelines
    • Submission of PRs
  • Block critical operations if the user's status is "not enabled".
  • Integrate with identity sources (e.g. GitHub, GitLab, Azure AD) to reflect onboarding status.

🔄 3. Continuous and adaptive feedback​

  • Use adaptive quizzes with reinforcement in weak areas, based on profile and history.
  • Correlate real errors in PRs or incidents with automatic reinforcement (e.g. microlearning).
  • Apply spaced repetition techniques, effectiveness metrics and optional gamification.

🔐 4. Assisted technical onboarding​

  • Create secure sandbox environments to validate knowledge (e.g. PR review, fault detection).
  • Include real cases and internal lessons learned in the training paths.
  • Monitor time, performance and drop-off points during onboarding.

🌍 5. Extension to suppliers and partners​

  • Make public or NDA-covered training tracks available to strategic partners.
  • Require training compliance with completion metrics before technical permissions.
  • Integrate training requirements into supplier qualification processes.

🧭 Integration with maturity frameworks​

📘 OWASP DSOMM - Training & Awareness​

LevelExpected practice in DSOMMCovered by the recommendations
L1Basic initial training (e.g. OWASP Top 10)✅
L2Continuous training per technical profile✅
L3Integration with technical processes (CI/CD, permissions, deploys)✅
L4Adaptive training, use of real data, effectiveness metrics, continuous feedback✅

✅ The recommendations described here make it possible to reach DSOMM level 4 in the Training & Awareness domain.

📘 SAMM v2.1 - Education & Guidance​

  • EDU.3 - Automated, role-specific training: The tracks per profile, gating via CI/CD and dashboards fully support this level.
  • The integration with technical onboarding, content per chapter and metrics are examples of continuous application of EDU.3.

📘 NIST SSDF v1.1 - PO.4​

  • PO.4.1 / PO.4.2: Establish that training must be updated on the basis of incidents and centred on roles.
  • PO.4.3 / PO.4.4: Support continuous measurement and review - as recommended with the dashboards and KPIs.

🧩 Progressive adoption​

Maturity LevelApplicable recommendations
InitialManual training, minimum validation, checklists in onboarding
IntermediateDefined tracks, centralised quizzes, basic indicators
HighLMS integration, continuous feedback, validation via CI/CD, assisted onboarding, extension to third parties

✅ Conclusion​

These advanced practices make training:

  • More effective, continuous and measurable
  • Integrated into the lifecycle and into technical permissions
  • Based on evidence, feedback and personalisation

📈 True security maturity is reflected in the ability to train, retain and upskill teams continuously and in a way adapted to risk and role.