Skip to main content

Foundations of the Technical Manual

This chapter establishes the conceptual and operational foundations of Security by Design – Theory of Everything (SbD-ToE).
It defines how the manual must be read, applied and governed, and clarifies the non-negotiable principles that guide every chapter.

SbD-ToE is not a catalogue of good practices, nor an optional guide.
It is a prescriptive model, proportional to risk, grounded in evidence and supported by formal mechanisms of organisational governance.

🧭 What this manual is (and is not)​

SbD-ToE is:

  • An integrated system for designing, developing, operating and governing secure software;
  • A model in which technical practices, people and organisational decisions are linked;
  • A manual applicable to applications, pipelines, infrastructure, teams and the relationship with suppliers.

SbD-ToE is not:

  • A set of optional recommendations;
  • A manual dependent on specific tools;
  • A model based on implicit trust or on untracked local decisions.

📚 Structure and navigation​

This chapter serves as the entry point to the foundations of the manual:

  1. How to Use the Manual
    Reading and application guide by profile (Dev, AppSec, Executive Management, Procurement, etc.).

  2. Roles and Responsibilities
    Clear definition of the roles involved, their responsibilities and their decision authority.

  3. Mandatory Baseline
    Minimum set of technical and organisational obligations that every application must meet, regardless of technology or team.

🏛️ Fundamental principles​

The following principles apply throughout the manual:

  • Security is neither optional nor local: practices that are not applied require a formal decision.
  • Automation executes, governance authorises: pipelines, tools and processes do not replace organisational responsibility.
  • Every exception is explicit, temporary and traceable.
  • The lifecycle is complete: training, onboarding, execution, continuous validation and offboarding are part of the model.
  • The manual prescribes to those who operate within its process: in its own domain it says how to do things; in other domains of the organisation it says what must exist, not how they work; from those who deliver from outside it asks for demonstrable alignment — a supplier's obligation arises from the contract, not from this manual.

These principles are operationalised in the organisational and technical chapters of the manual.