How to Use This Manual
This manual was designed to support technical teams, managers and decision-makers in the practical implementation of Security by Design in software development.
Its aim is to turn good intentions into concrete and sustainable actions, adapted to the real risk and maturity of each organisation, dispelling any notion of complexity and difficulty attached to it.
Security by Design is a path, "made by walking", and this manual teaches the steps to follow so that everyone can apply the practices.
🎯 Who it is for
This manual is useful for:
- Development and DevOps teams
- Software and solution architects
- Security team (AppSec, GRC, CISO)
- Product, project and quality managers
- Operations, cloud and infrastructure team
🧱 Structure of the manual
The manual is divided into 14 chapters, each applicable independently, but grouped for convenience into 4 organisational groups:
Ⅰ - Foundations and Organisational Context
Principles, governance, risk and upskilling.
Ⅱ - Secure Engineering
From requirement to testable design.
Ⅲ - Implementation and Automation
Pipelines, IaC, containers and testing.
Ⅳ - Operation and Continuous Improvement
Execution, observability and response.
🧭 How to navigate
Each chapter (01–14) follows the same pattern:
- Summary — Purpose and context
- How to Do It — What to do, when and by whom, in the form of normalised user stories
- Policies — describes which policies must be instituted to enforce the practices across the organisation
- Technical Supplement — Detailed explanation of the prescribed practices, with examples, tools and scenarios
- Advanced Recommendations — In some cases and for specialised contexts
Reading by process: the five macro-processes describe what must remain connected across chapters — cross-cutting paths, with control points and indicators.
🏷️ Symbols and Icons
- ⭐ — Foundational (mandatory at every level)
- ⚙️ — Operational (depends on the level and context)
- 🏛️ — Organisational (governance and compliance)
- 📚 — Technical Supplement (optional deep dive)
- US — User Story (activity for a specific role)
🔄 Proportionality (L1–L3)
SbD-ToE adapts to risk:
- L1 — Low risk (prototypes, internal systems)
- L2 — Moderate risk (most applications in production)
- L3 — Critical (sensitive data, critical infrastructure)
Each chapter states what it prescribes for each level, ensuring that the prescription is proportional to the "risk" of the application.
🛠️ How to apply in practice
📘 Linear reading
Recommended for teams structuring processes or audits:
Follow the natural order of the chapters (1 to 14), starting with risk management.
🧩 Modular reading
Recommended for specific initiatives (e.g. a focus on secure CI/CD):
Allows chapter-by-chapter reading, with independent application.
✅ In an audit context
- Each chapter has a verifiable checklist with objective criteria
- The items are binary: yes / no
- The absence of foundational chapters invalidates the maturity assessment
📊 In maturity assessment
-
The contents are aligned with recognised frameworks:
- OWASP SAMM - Design, Implementation and Verification domains
- NIST SSDF - PO.x, RV.x and PP.x
- SLSA - Levels 2 to 3 of supply chain security
-
They index the resolution of common threats (ASVS, CAPEC, OSC&R, et al.)
-
They respond, in the context of application development, to the emerging requirements of:
- NIS2
- DORA
- CRA
🧠 In team onboarding
This manual can be used as:
- A structured introduction to security by technical domain
- A base of good practices for pipelines and operations
- Training material for Champions and mentoring programmes