Developer
Overview
Developers are the front line of the practical implementation of security by design.
It is in the act of writing code that a large part of the security practices prescribed in the SbD-ToE materialise.
Key Responsibilities
- Write code in accordance with security guidelines (Ch. 06)
- Fix vulnerabilities identified in reviews and scans
- Contribute to threat modelling and provide technical information on data flows (Ch. 03)
- Ensure that the software meets functional and security requirements in a robust and traceable way
Organisational Context
The Developer role is cross-cutting to almost the whole Manual. The responsibility is twofold: deliver functionality and ensure security. Without the active collaboration of developers, no security policy materialises.
Regulatory Framework
The Developer's work gives effect to obligations under:
- NIS2: Secure development practices and vulnerability management
- DORA: Digital resilience in financial systems
- GDPR: Security by design principles
- AI Act: Security and transparency in AI systems
Activities by Chapter
Ch. 01 - Criticality Classification
Provide technical information on the application's dependencies, integrations and operational impact, contributing to the risk assessment and to determining the criticality level (L1/L2/L3).
User Stories:
- US-01: Initial classification of the application - Apply the E+D+I model to determine the L1–L3 level
- US-02: Applying the control matrix - Map requirements to the Ch. 02 requirements
Ch. 02 - Security Requirements
Implement the minimum security requirements derived from the classification, integrating them into the definition of done and ensuring compliance in every delivery.
User Stories:
- US-03: Exception Management with TTL and Revalidation - Record formal exceptions with TTL and AppSec approval
- US-11: SBOM generation and artefact signing - Automatic SBOM and artefact signing
- US-12: Validation of SEC-Lx-* tags in the pipeline - Automatic traceability of requirements
Ch. 03 - Threat Modelling
Take an active part in threat modelling sessions, translating diagrams and threat scenarios into practical controls implemented in code.
User Stories:
- US-01: Creating the threat model - DFDs and STRIDE/LINDDUN at the start of the project
Ch. 04 - Secure Architecture
Ensure that the implementation respects the defined architectural patterns. Keep the architecture sheet up to date when critical changes occur.
User Stories:
- US-04: Architecture update on critical changes - Update the architecture sheet when structural changes arise
Ch. 05 - Dependencies and SBOM
Explicitly declare all libraries and dependencies used, supporting the creation of auditable inventories (SBOM) essential for vulnerability management.
User Stories:
- US-01: Secure dependency management - Use only approved dependencies
- US-07: Prohibit manually copied libraries - Use package managers, never manual copies
- US-12: Automatic validation of licence compatibility - Ensure legal compliance
Ch. 06 - Secure Development
Follow secure coding guidelines, use linters and automatic validation, fix SAST findings. Prevent trivial vulnerabilities through tools integrated into the development workflow.
User Stories:
- US-01: Secure Development Guidelines - Apply the approved guidelines per stack
- US-06: Validated Use of GenAI - Generative AI with mandatory review
- US-08: Traceability with Security Annotations - Annotate each validation with @sec:*
- US-12: Mandatory Local Validation - Linters and pre-commit validation
Ch. 07 - Secure CI/CD
Collaborate with DevOps on configuring secure pipelines, ensuring that code passes through security gates (SAST, dependency check) before being merged or deployed.
User Stories:
- US-01: Secure source code management - PRs with mandatory review and branch protection
- US-03: Integrated scanners - SAST, secrets scanning and blocking of critical failures
Ch. 08 - IaC (Infrastructure as Code)
Collaborate on the writing and validation of secure IaC templates, ensuring that infrastructure is versioned and auditable.
User Stories:
- US-03: Integrated automatic validation - Mandatory linters, scanners and policy-as-code
Ch. 09 - Containers and Images
Build images from trusted, versioned bases (SHA256 digest). Ensure that Dockerfiles follow security best practices.
User Stories:
- US-01: Trusted base images - Use only official images with a SHA256 digest
Ch. 10 - Security Testing
Run automatic SAST on the PR with inline comments, fixing vulnerabilities before merge. Create regression tests for fixed findings.
User Stories:
- US-02: Automatic SAST on the PR - Static analysis with contextual feedback
- US-05: Security regression tests - Prevent the reintroduction of vulnerabilities
Ch. 11 - Secure Deployment
Maintain semantic versioning with a technical and security changelog. Ensure that only validated artefacts are promoted between environments.
User Stories:
- US-01: Semantic versioning + changelog - Complete traceability of changes
Ch. 12 - Monitoring and Operations
Implement structured, centralised logging, generating events with enough context for incident detection and investigation.
User Stories:
- US-01: Structured logs + centralisation - Ensure full visibility during incidents
Ch. 13 - Training and Onboarding
Take part in continuous upskilling programmes and, as Security Champion, lead threat modelling sessions per feature, epic or refactor.
User Stories:
- US-06: Threat modelling per feature/epic/refactor - Security Champion leads the threat analysis
Ch. 14 - Governance and Contracting
Submit security exceptions through a formal flow with automatic routing by risk level. Maintain a structured compliance repository for each application (with the Scrum Master / Team Lead).
User Stories:
- US-03: Security exceptions + approval workflow - Formal exception management
- US-06: Compliance repository per application - Centralise evidence and documentation
Chapter References
For full context and framing:
- Ch. 01 - Application Classification
- Ch. 02 - Security Requirements
- Ch. 03 - Threat Modelling
- Ch. 04 - Secure Architecture
- Ch. 05 - Dependencies and SBOM
- Ch. 06 - Secure Development
- Ch. 07 - Secure CI/CD
- Ch. 08 - IaC and Infrastructure
- Ch. 09 - Containers and Images
- Ch. 10 - Security Testing
- Ch. 11 - Secure Deployment
- Ch. 12 - Monitoring and Operations
- Ch. 13 - Training and Onboarding
- Ch. 14 - Governance and Contracting