Threat and misuse analysis
Identify valuable assets, trust boundaries, likely abuse paths, and failure consequences.
Engineering Standards / Secure Delivery
Security belongs inside the delivery system.
Security work follows the system from architecture through deployment and operation. The specific controls depend on exposure, data, users, environment, and consequence.
01Architecture
02Implementation
03Delivery pipeline
04Runtime operation
Control areas
Security decisions across the lifecycle.
A single scan cannot establish whether a system is secure. Controls must connect design intent, implementation, deployment, and accountable operation.
Identity and access
Define people, services, privileges, approval boundaries, and access lifecycle.
Secrets and data
Control credentials, sensitive data movement, storage, exposure, and rotation.
Code and dependencies
Review critical implementation, third-party components, provenance, and remediation decisions.
Pipeline and environments
Protect builds, artefacts, deployment authority, configuration, and separation of duties.
Runtime readiness
Prepare logging, detection, response ownership, recovery, and controlled emergency access.
Shared responsibility
Clear ownership is a security control.
Root Digit
Engineering controls, implementation evidence, technical risks, and remediation recommendations within the agreed scope.
Client organisation
Business authority, production access policy, data classification, risk acceptance, and operating ownership.
Jointly governed
Architecture decisions, release criteria, incident interfaces, exceptions, and changes to the threat environment.
Security and assurance enquiry