Product Owner (PO)
Overview
The Product Owner balances business and security, ensuring that security is not seen as a cost but as value intrinsic to the product.
Responsible for prioritising security requirements, validating the impact of architectural decisions and authorising releases only when the criteria are met.
Key Responsibilities
- Balance business priorities with security requirements
- Ensure that security stories enter and remain in the backlog
- Approve acceptance criteria that include security
- Take go/no-go decisions informed by risk analysis
Organisational Context
The PO supports obligations under DORA (integration of security and digital continuity into all products) and NIS2 (integration of risk management into business processes).
Regulatory Framework
Supports:
- DORA: Integration of digital resilience into the lifecycle
- NIS2: Incorporation of risk management into the business
Activities by Chapter
Ch. 01 - Application Classification
Validate risk classifications against the product's strategic objectives.
Ch. 02 - Security Requirements
Select requirements applicable to the project in proportion to risk. Ensure that each requirement in the backlog contains clear, testable security acceptance criteria.
User Stories:
- US-01: Selection of applicable requirements - Security proportional to risk
- US-03: Security acceptance criteria - Consistent validation
Ch. 03 - Threat Modelling
Prioritise identified threats according to business impact, optimising mitigation and investment.
User Stories:
- US-05: Threat prioritisation by impact - Optimise mitigation resources
Ch. 04 - Secure Architecture
Validate the impact of architecture requirements to prioritise mitigation. Manage exceptions with approval and compensating controls.
User Stories:
- US-06: Requirement impact validation - Prioritise mitigation
- US-10: Architecture exception management - Balance risk and delivery (with AppSec Engineer)
Ch. 05 - Dependencies and SBOM
Validate findings and exceptions before go-live, taking an informed go/no-go decision based on risk analysis.
User Stories:
- US-05: Release validation (go/no-go) - Informed decision before go-live
Ch. 07 - Secure CI/CD
Define release gates that block insecure versions, ensuring compliance with established thresholds.
Ch. 11 - Secure Deployment
Authorise only releases whose security criteria are met, validating that controls are in place.
Ch. 13-14 - Training and Governance
Ensure that training and contractual clauses reflect secure practices and support product decisions.
Chapter References
For full context and framing: