Governance of Legacy Systems and Non-Compliant Contexts
This document addresses the proportional and adapted application of the SbD-ToE model to legacy systems, old pipelines, pre-existing contracts or organisational contexts where full control is not immediate or feasible.
🌟 Objective
- To allow legacy projects to be framed within a structured governance model;
- To guarantee visibility, traceability and compensations even when it is not possible to apply all the requirements;
- To avoid silent exceptions that put the coherence of the SbD-ToE model at risk.
🧰 Typical contexts
- Inherited critical applications without technical documentation or active owners;
- Old CI/CD pipelines, operational but outside the control of the AppSec team;
- Contracts in force with suppliers that do not meet the minimum requirements;
- Shared libraries or modules without security review.
🛠️ Proposed approach
-
Identify and classify the legacy asset (using the criteria of Ch. 1);
-
Map the applicable requirements, even if not met;
-
Analyse the feasibility of the technical application of controls;
-
Record formal exceptions, where applicable, with:
- Business justification
- Acknowledged risks
- Proposed compensations
- Validity and reassessment plan
-
Include the asset in the continuous review cycle (
addon/06-validacao-continuada.md)
📋 Example of a legacy governance record
| Field | Value |
|---|---|
| System | Internal DataBroker |
| Risk level | L3 |
| Requirements not met | EX-AUD-002, LOG-003 |
| Justification | Core system dependent on pre-existing architecture |
| Compensations | Monitoring by external SIEM + access control |
| Owner | joana.sousa@empresa |
| Scheduled reassessment | 6 months (future integration with a new project) |
Illustrative identifiers (EX-…); they do not correspond to the Requirements Catalogue of Ch. 02.
✅ Recommendations
- Never ignore legacy assets: treat them as a formal exception with traceability;
- Incorporate the cycle of review and continuous improvement;
- Monitor compensations and document deviations transparently;
- Include these cases in the maturity and governance KPIs.
🔗 Cross-links
- Ch. 1 - Risk classification
- Ch. 2 - Minimum requirements by risk
addon/01-modelo-governancao.md- Decision and exceptions modeladdon/06-validacao-continuada.md- Continuous validation- Ch. 08 / 09 - Integration with pipelines and isolated execution