Skip to main content

Governance and Organisational Maturity

This annex describes how Chapter 14 contributes to the organisation's security maturity, based on the SAMM, SSDF and SLSA models, and how these practices translate into effective control. Organisational maturity does not result merely from increased automation, but from the capacity to frame it within a clear governance model, with explicit, traceable and revocable authority.

🔄 2. Maturity scaling​

LevelKey characteristic
1Ad hoc application of requirements, without traceability or formal validation
2Exception model defined, requirements mapped to risk, contracts updated
3Complete traceability, designated owners, automated recurring validation with explicit governance of authority

🔹 Ch. 14 provides the organisational elements to reach maturity Level 3.

🌍 3. Cross-cutting application​

Governance maturity affects all the other chapters:

  • It defines when and how to apply requirements (Ch. 2);
  • It prevents untracked exceptions (Ch. 1);
  • It controls the quality of integration and third parties (Ch. 5, 7, 9);
  • It establishes formal validation mechanisms (Ch. 10, 11, 12).

🗓️ 4. Maturity as an evolving programme​

The evolution of the SbD-ToE model may be guided by:

  • Formal adoption of the governance model (addon/01-modelo-governancao.md);
  • Integration of reviews and exceptions into a quarterly cycle;
  • Generation of KPIs and dashboards (kpis-governanca.md);
  • Cross audits across applications, contracts and traceability.

✅ Final recommendations​

  • Review the governance structure and assigned roles annually;
  • Consolidate operational data (checklists) with process data (decisions);
  • Monitor the evolution of maturity using external frameworks as a baseline.

🔗 Cross-links​

  • achievable-maturity.md of each chapter
  • addon/01 to addon/07 - components supporting maturity
  • kpis-governanca.md - Governance KPIs