Skip to main content

Advanced Recommendations - Governance and Contracting

This file includes practices that reinforce application security governance in organisational contexts with greater maturity, contractual complexity or regulatory demands.

🏢 1. Distributed governance with central control​

  • Definition of security owners per domain or organisational unit;
  • A federated exception model, with central review (GRC or AppSec board);
  • A catalogue of previous risk decisions (with reuse and precedents);
  • Periodic review of contractual security with procurement.

🤖 2. Automation of traceability and compliance​

  • Automatic linkage between findings → exceptions → owners → contracts;
  • Use of GRC systems integrated with the pipeline (e.g. Jira + GitHub + evidence);
  • Automation of exception revalidation based on TTL and new data (e.g. CVSS, known exploits).

🌐 3. Third parties and the contractual chain​

  • Continuous supplier scorecard (traceability + findings + training);
  • Clauses with explicit obligations regarding: SBOM, SCA, training, secure lifecycle;
  • Validation of suppliers' threat modelling models and security maturity.

🧾 4. Transparency and audit​

  • Publication of security governance reports aggregated by unit or project;
  • Governance reviews supported by technical committees or external audits;
  • Integration of security requirements as a condition of contractual acceptance.

🎓 5. Training and organisational culture​

  • Training of owners as security ambassadors;
  • Specific tracks per contractual function: procurement, legal, product management;
  • Dashboards shared with internal stakeholders (GRC, board, management).

❗ These recommendations are applicable to organisations with:

  • Mature DevSecOps models;
  • Significant regulatory responsibility (finance, healthcare, public administration);
  • A need for continuous visibility and auditable governance.

🔗 Cross-references​

  • Ch. 1 - Risk model and ownership
  • Ch. 2 - Application requirements
  • Ch. 5 - Traceability and exceptions
  • Ch. 13 - Training and onboarding
  • addon/01 to addon/07 - Governance and contracting processes