---
title: 'SBD-01: Security Governance'
description: Secure by Design reference for security governance covering risk ownership, senior accountability, and organizational security culture
---

# 01 Security Governance

Identifier: SBD-01
Category: Governance

## Source mapping

* **UK Principle 1** — Create responsibility for cyber security risk
* **AU Foundation 1** — Holistic secure organisation

## Description

Security governance ensures that cyber security risk is owned at the senior leadership level and
that appropriate resources are allocated throughout the service lifecycle. Secure by Design is a
whole-of-organisation responsibility requiring action and commitment beyond operational or
technical teams. Organisations must align business drivers with cyber security goals, ensuring each
business area understands its role in building and improving security maturity.

Risk owners must be senior stakeholders with the experience, knowledge, and authority to lead on
security activities. Organisational mentality must shift from viewing security as an inhibitor to
recognizing it as an enabler of productivity and efficiency.

## Principle checklist

* A named risk owner is accountable for managing cyber security risks for the service.
* Security is considered at the senior leadership level in accordance with the project risk appetite.
* Appropriate resources are allocated to manage security risks throughout the lifecycle.
* Security roles and responsibilities are documented and assigned across the team.
* Security maturity is tracked, reported, and linked to commercial or project outcomes.
* A continuous improvement process exists for security practices.
* Security awareness training is provided to all team members with role-specific depth.

## Controls and mitigations

1. Assign a named security risk owner with authority to prioritize security work.
2. Include security considerations in business cases and project charters.
3. Establish a security champion or advocate role within each delivery team.
4. Link security maturity metrics to project milestones and delivery gates.
5. Conduct regular security risk reviews at the leadership level.
6. Invest in role-specific security training for developers, architects, and operations staff.
7. Maintain transparency about known security risks and mitigation status.

## Anti-patterns

* Security is treated as an afterthought or "phase" rather than an ongoing concern.
* No individual is accountable for security risk decisions.
* Security resources are allocated only after incidents occur.
* Security awareness training is a one-time checkbox exercise.
* Security findings are deprioritized without risk-based justification.
* Security culture is siloed within a single team rather than shared across the organisation.

## OWASP cross-references

* A06:2025 Insecure Design — governance failures lead to systemic design weaknesses.
* A02:2025 Security Misconfiguration — lack of ownership results in configuration drift.

---

Content derived from works by the **UK Government Security Group** (Crown Copyright) licensed
under the [Open Government Licence v3.0](https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/)
and the **Australian Signals Directorate / ACSC** (© Commonwealth of Australia) licensed under
[CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/).
Modifications: Synthesized into structured principle-checklist format with OWASP cross-references;
merged UK and AU guidance into unified principle areas.