Security Compliance

6. Risk-Based Approach

Prioritize security efforts based on risk assessment, focusing resources on the most critical assets and likely threats.

7. Compliance as Foundation

Use compliance frameworks as a baseline, but go beyond minimum requirements to achieve actual security.

8. Incident Readiness

Prepare for security incidents through planning, testing, and regular tabletop exercises. Assume compromise will occur.

Security & Compliance Lifecycle

Phase 1: Assess & Plan

Objective: Understand current security posture and compliance requirements

Activities:

• Conduct security assessments and gap analysis
• Identify compliance requirements (SOC2, ISO27001, GDPR, HIPAA, PCI-DSS)
• Perform risk assessments and threat modeling
• Define security policies and standards
• Establish security governance structure
• Create security roadmap with prioritized initiatives

Deliverables:

• Risk register with prioritized risks
• Compliance gap analysis report
• Security architecture documentation
• Security policies and procedures
• Security roadmap and budget

Phase 2: Design & Architect

Objective: Design secure systems and architectures

Activities:

• Design defense-in-depth architectures
• Implement Zero Trust network architecture
• Design identity and access management (IAM) systems
• Architect data protection and encryption solutions
• Design secure CI/CD pipelines
• Create threat models for applications and systems
• Define security controls and compensating controls

Deliverables:

• Security architecture diagrams
• Threat models (STRIDE, PASTA, or attack trees)
• Data flow diagrams with security boundaries
• Encryption and key management design
• IAM design with RBAC/ABAC models
• Security control matrix

Phase 3: Implement & Harden

Objective: Deploy security controls and harden systems

Activities:

• Implement security controls (preventive, detective, corrective)
• Configure security tools (SIEM, EDR, CASB, WAF, IDS/IPS)
• Harden operating systems and applications
• Implement encryption at rest and in transit
• Deploy multi-factor authentication (MFA)
• Configure logging and monitoring
• Implement data loss prevention (DLP)
• Set up vulnerability management program

Deliverables:

• Hardening baselines and configuration standards
• Deployed security tools and controls
• Encryption implementation
• MFA deployment
• Security monitoring dashboards
• Vulnerability management procedures

Phase 4: Monitor & Detect

Objective: Continuously monitor for threats and anomalies

Activities:

• Monitor security logs and events (SIEM)
• Analyze security alerts and anomalies
• Conduct threat hunting
• Perform vulnerability scanning and penetration testing
• Monitor compliance controls
• Track security metrics and KPIs
• Review access logs and privileged account activity
• Analyze threat intelligence feeds

Deliverables:

• Security operations center (SOC) runbooks
• Alert triage and escalation procedures
• Threat hunting playbooks
• Vulnerability scan reports
• Penetration test reports
• Security metrics dashboard
• Compliance monitoring reports

Phase 5: Respond & Recover

Objective: Respond to security incidents and recover operations

Activities:

• Execute incident response plan
• Contain and eradicate threats
• Perform forensic analysis
• Recover affected systems
• Conduct post-incident reviews
• Update security controls based on lessons learned
• Report incidents to stakeholders and regulators
• Improve detection rules and response procedures

Deliverables:

• Incident response reports
• Forensic analysis findings
• Root cause analysis
• Remediation plans
• Updated incident response playbooks
• Regulatory breach notifications (if required)
• Post-incident review and recommendations

Phase 6: Audit & Improve

Objective: Validate compliance and continuously improve security

Activities:

• Conduct internal audits
• Prepare for external audits (SOC2, ISO27001)
• Perform compliance assessments
• Review and update security policies
• Conduct security training and awareness programs
• Perform tabletop exercises and disaster recovery drills
• Update risk assessments
• Implement security improvements

Deliverables:

• Audit reports (internal and external)
• SOC2 Type II report
• ISO27001 certification
• Compliance attestations
• Updated policies and procedures
• Training completion metrics
• Tabletop exercise results
• Continuous improvement plan

Decision Frameworks

1. Risk Assessment Framework

When to use: Evaluating security risks and prioritizing mitigation efforts

Process:

1. Identify Assets
   - What systems, data, and services need protection?
   - What is the business value of each asset?
   - Who are the asset owners?

2. Identify Threats
   - What threat actors might target these assets? (nation-state, cybercriminals, insiders)
   - What are their motivations? (financial gain, espionage, disruption)
   - What are current threat trends?

3. Identify Vulnerabilities
   - What weaknesses exist in systems or processes?
   - What security controls are missing or ineffective?
   - What are known CVEs affecting your systems?

4. Calculate Risk
   Risk = Likelihood × Impact

   Likelihood scale (1-5):
   1 = Rare (< 5% chance in 1 year)
   2 = Unlikely (5-25%)
   3 = Possible (25-50%)
   4 = Likely (50-75%)
   5 = Almost Certain (> 75%)

   Impact scale (1-5):
   1 = Minimal (< $10K loss, no data breach)
   2 = Minor ($10K-$100K, limited data exposure)
   3 = Moderate ($100K-$1M, significant data breach)
   4 = Major ($1M-$10M, extensive data breach, regulatory fines)
   5 = Catastrophic (> $10M, business-threatening)

   Risk Score = Likelihood × Impact (max 25)

5. Prioritize Risks
   - Critical: Risk score 15-25 (immediate action)
   - High: Risk score 10-14 (action within 30 days)
   - Medium: Risk score 5-9 (action within 90 days)
   - Low: Risk score 1-4 (monitor and accept)

6. Determine Risk Response
   - Mitigate: Implement controls to reduce risk
   - Accept: Document acceptance if risk is within tolerance
   - Transfer: Use insurance or third-party services
   - Avoid: Eliminate the activity that creates risk

Output: Risk register with prioritized risks and mitigation plans

2. Security Control Selection

When to use: Choosing appropriate security controls for identified risks

Framework: Use NIST CSF categories or CIS Controls

NIST CSF Functions:
1. Identify (ID)
   - Asset Management
   - Risk Assessment
   - Governance

2. Protect (PR)
   - Access Control
   - Data Security
   - Protective Technology

3. Detect (DE)
   - Anomalies and Events
   - Security Monitoring
   - Detection Processes

4. Respond (RS)
   - Response Planning
   - Communications
   - Analysis and Mitigation

5. Recover (RC)
   - Recovery Planning
   - Improvements
   - Communications

Control Types:
- Preventive: Stop incidents before they occur (MFA, firewalls, encryption)
- Detective: Identify incidents when they occur (SIEM, IDS, log monitoring)
- Corrective: Fix issues after detection (patching, incident response)
- Deterrent: Discourage attackers (security policies, warnings)
- Compensating: Alternative controls when primary controls aren't feasible

Selection Criteria:
1. Does it address the identified risk?
2. Is it cost-effective? (Control cost < Risk value)
3. Is it technically feasible?
4. Does it meet compliance requirements?
5. Can we maintain and monitor it?

3. Compliance Framework Selection

When to use: Determining which compliance frameworks to implement

Decision Tree:

What type of organization are you?

├─ SaaS/Cloud Service Provider
│  ├─ Selling to enterprises? → SOC2 Type II (required)
│  ├─ International customers? → ISO27001 (strongly recommended)
│  ├─ Handling health data? → HIPAA + HITRUST
│  └─ Handling payment cards? → PCI-DSS

├─ Healthcare Provider/Payer
│  ├─ U.S.-based → HIPAA (required)
│  ├─ International → HIPAA + GDPR
│  └─ Plus: HITRUST for comprehensive framework

├─ Financial Services
│  ├─ U.S. banks → GLBA, SOX (if public)
│  ├─ Payment processing → PCI-DSS (required)
│  ├─ International → ISO27001, local regulations
│  └─ Plus: NIST CSF for framework

├─ E-commerce/Retail
│  ├─ Accept credit cards → PCI-DSS (required)
│  ├─ EU customers → GDPR (required)
│  ├─ California customers → CCPA
│  └─ B2B sales → SOC2 Type II

└─ General Enterprise
   ├─ Selling to enterprises → SOC2 Type II
   ├─ Want broad recognition → ISO27001
   ├─ Government contracts → FedRAMP, NIST 800-53
   └─ Industry-specific → Check sector regulations

Multi-Framework Strategy:
- Start with: SOC2 or ISO27001 (choose one as foundation)
- Add: Data privacy regulations (GDPR, CCPA) as needed
- Layer on: Industry-specific requirements

4. Incident Severity Classification

When to use: Triaging and responding to security incidents

Severity Levels:

P0 - Critical (Immediate Response)
- Active breach with data exfiltration occurring
- Ransomware encryption in progress
- Complete system outage of critical services
- Unauthorized access to production databases
- Response: Engage CIRT immediately, executive notification, 24/7 effort

P1 - High (Response within 1 hour)
- Confirmed malware on critical systems
- Attempted unauthorized access to sensitive data
- DDoS attack affecting availability
- Significant vulnerability with active exploits
- Response: Engage CIRT, manager notification, work until contained

P2 - Medium (Response within 4 hours)
- Malware on non-critical systems
- Suspicious account activity
- Policy violations with security impact
- Vulnerability requiring patching
- Response: Security team investigation, business hours

P3 - Low (Response within 24 hours)
- Failed login attempts (below threshold)
- Minor policy violations
- Informational security events
- Response: Standard queue, document findings

Classification Factors:
1. Data confidentiality impact (PHI, PII, financial, IP)
2. System availability impact (revenue, operations)
3. Data integrity impact (corruption, unauthorized changes)
4. Number of affected systems/users
5. Regulatory reporting requirements

5. Vulnerability Prioritization

When to use: Prioritizing vulnerability remediation

Framework: Enhanced CVSS with business context

Base CVSS Score × Business Context Multiplier = Priority Score

CVSS Severity Ranges:
- Critical: 9.0-10.0
- High: 7.0-8.9
- Medium: 4.0-6.9
- Low: 0.1-3.9

Business Context Multipliers:
- Internet-facing production system: 2.0×
- Internal production system: 1.5×
- Systems with sensitive data: 1.5×
- Development/test environment: 0.5×
- Active exploit in the wild: 2.0×
- Compensating controls in place: 0.7×

Priority Levels:
- P0 (Critical): Score ≥ 14 → Patch within 24-48 hours
- P1 (High): Score 10-13.9 → Patch within 7 days
- P2 (Medium): Score 6-9.9 → Patch within 30 days
- P3 (Low): Score < 6 → Patch within 90 days or accept risk

Additional Considerations:
- Can the system be isolated/segmented?
- Are there effective detective controls?
- What is the patching complexity/risk?
- Is there a vendor patch available?

6. Third-Party Risk Assessment

When to use: Evaluating security risks of vendors and partners

Assessment Framework:

1. Categorize Vendor Risk Level

Low Risk (Minimal assessment):
- No access to systems or data
- Limited integration
- Non-critical service
→ Simple questionnaire

Medium Risk (Standard assessment):
- Limited system access
- Non-sensitive data access
- Important but not critical service
→ Security questionnaire + evidence review

High Risk (Comprehensive assessment):
- Production system access
- Sensitive data processing
- Critical service dependency
→ Full assessment + audit reports + pen test

Critical Risk (Extensive assessment):
- Full production access
- PHI/PII processing
- Business-critical dependency
→ On-site audit + continuous monitoring + SLA

2. Assessment Components

For Medium/High/Critical vendors:
□ Security questionnaire (SIG, CAIQ, or custom)
□ Compliance certifications (SOC2, ISO27001)
□ Insurance certificates (cyber liability)
□ Security policies and procedures
□ Incident response plan
□ Disaster recovery/business continuity plan
□ Data processing agreement (DPA)
□ Penetration test results (for high/critical)
□ Right to audit clause in contract

3. Ongoing Monitoring

- Annual reassessment
- Monitor for breaches/incidents
- Review security updates and patches
- Track compliance certification renewals
- Conduct periodic audits (for critical vendors)

4. Vendor Risk Score

Calculate score (0-100):
- Security maturity: 40 points
- Compliance certifications: 20 points
- Incident history: 15 points
- Financial stability: 15 points
- References and reputation: 10 points

Action based on score:
- 80-100: Approved
- 60-79: Approved with conditions
- 40-59: Requires remediation plan
- < 40: Do not engage

Key Security Frameworks & Standards

NIST Cybersecurity Framework (CSF)

• Purpose: Risk-based framework for improving cybersecurity
• Structure: 5 Functions, 23 Categories, 108 Subcategories
• Best for: General organizations, government contractors
• Maturity model: Tier 1 (Partial) to Tier 4 (Adaptive)

CIS Critical Security Controls

• Purpose: Prioritized set of actions for cyber defense
• Structure: 18 Controls with Implementation Groups (IG1, IG2, IG3)
• Best for: Practical implementation guidance
• Focus: Defense against common attack patterns

ISO/IEC 27001

• Purpose: International standard for information security management
• Structure: 14 domains, 114 controls (Annex A)
• Best for: International recognition, formal certification
• Requirements: ISMS (Information Security Management System)

SOC 2 Type II

• Purpose: Service organization controls for security and availability
• Structure: Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy)
• Best for: SaaS companies, cloud service providers
• Audit: 3-12 month observation period

NIST 800-53

• Purpose: Security controls for federal systems
• Structure: 20 families, 1000+ controls
• Best for: Government contractors, FedRAMP
• Baselines: Low, Moderate, High impact systems

GDPR (General Data Protection Regulation)

• Purpose: EU data privacy regulation
• Scope: Any organization processing EU residents' data
• Requirements: Lawful basis, consent, data subject rights, breach notification
• Penalties: Up to 4% of global revenue or €20M

HIPAA (Health Insurance Portability and Accountability Act)

• Purpose: Protect health information (PHI)
• Scope: Healthcare providers, payers, business associates
• Requirements: Administrative, Physical, Technical safeguards
• Penalties: $100-$50,000 per violation, criminal charges possible

PCI-DSS (Payment Card Industry Data Security Standard)

• Purpose: Protect cardholder data
• Structure: 12 requirements, 6 control objectives
• Scope: Any organization storing, processing, or transmitting card data
• Levels: Based on transaction volume (Level 1-4)

Core Security Domains

1. Identity & Access Management (IAM)

• Authentication mechanisms (MFA, SSO, passwordless)
• Authorization models (RBAC, ABAC, ReBAC)
• Privileged access management (PAM)
• Identity governance and administration (IGA)
• Directory services (Active Directory, LDAP, Okta, Auth0)

2. Network Security

• Network segmentation and micro-segmentation
• Firewalls (next-gen, WAF, application-layer)
• Intrusion detection/prevention (IDS/IPS)
• VPN and secure remote access
• Zero Trust network architecture (ZTNA)
• DDoS protection

3. Data Security

• Encryption at rest and in transit (AES-256, TLS 1.3)
• Key management (KMS, HSM)
• Data classification and labeling
• Data loss prevention (DLP)
• Database security (encryption, masking, tokenization)
• Secrets management (Vault, AWS Secrets Manager)

4. Application Security

• Secure SDLC and DevSecOps
• SAST (Static Application Security Testing)
• DAST (Dynamic Application Security Testing)
• SCA (Software Composition Analysis)
• Secure code review
• OWASP Top 10 mitigation

5. Cloud Security

• Cloud security posture management (CSPM)
• Cloud access security broker (CASB)
• Container security (image scanning, runtime protection)
• Serverless security
• Infrastructure as Code (IaC) security scanning
• Multi-cloud security architecture

6. Endpoint Security

• Endpoint detection and response (EDR)
• Antivirus and anti-malware
• Host-based firewalls
• Device encryption (BitLocker, FileVault)
• Mobile device management (MDM)
• Patch management

7. Security Operations

• Security Information and Event Management (SIEM)
• Security Orchestration, Automation, and Response (SOAR)
• Threat intelligence platforms (TIP)
• Threat hunting
• Vulnerability management
• Penetration testing and red teaming

8. Incident Response

• Incident response plan and playbooks
• Computer forensics and investigation
• Malware analysis
• Threat containment and eradication
• Post-incident review and lessons learned
• Regulatory breach notification

9. Governance, Risk & Compliance (GRC)

• Security policies and procedures
• Risk assessment and management
• Compliance management and auditing
• Security awareness training
• Vendor risk management
• Business continuity and disaster recovery

Security Metrics & KPIs

Risk & Compliance Metrics

• Number of critical/high risks open
• Risk remediation time (mean time to remediate)
• Compliance audit findings (open/closed)
• Compliance control effectiveness rate
• Policy acknowledgment completion rate
• Training completion rate

Vulnerability Management Metrics

• Mean time to detect (MTTD) vulnerabilities
• Mean time to patch (MTTP)
• Vulnerability backlog (total open, by severity)
• Patch compliance rate (% systems patched within SLA)
• Vulnerability recurrence rate

Incident Response Metrics

• Mean time to detect (MTTD) incidents
• Mean time to respond (MTTR)
• Mean time to contain (MTTC)
• Mean time to recover (MTTR)
• Number of incidents by severity
• Incident recurrence rate
• False positive rate

Security Operations Metrics

• SIEM alert volume (total, by severity)
• Alert triage time
• Alert false positive rate
• Security tool coverage (% assets monitored)
• Threat hunting coverage (% environment reviewed)
• Penetration test findings

Access Management Metrics

• MFA adoption rate
• Privileged account review completion rate
• Access certification completion rate
• Orphaned account count
• Password policy compliance rate
• Failed login attempt rate

Awareness & Culture Metrics

• Phishing simulation click rate
• Security training completion rate
• Security awareness quiz scores
• Security policy violations
• Security-related helpdesk tickets

Security Tools Ecosystem

SIEM (Security Information & Event Management)

• Splunk Enterprise Security
• IBM QRadar
• Microsoft Sentinel
• Elastic Security
• Sumo Logic

EDR/XDR (Endpoint/Extended Detection & Response)

• CrowdStrike Falcon
• SentinelOne
• Microsoft Defender for Endpoint
• Palo Alto Cortex XDR
• Carbon Black

Vulnerability Management

• Tenable Nessus/Tenable.io
• Qualys VMDR
• Rapid7 InsightVM
• Greenbone OpenVAS (open source)

Cloud Security

• Wiz
• Prisma Cloud (Palo Alto)
• Lacework
• Orca Security
• AWS Security Hub / Azure Security Center / GCP Security Command Center

SAST/DAST

• Snyk
• Veracode
• Checkmarx
• SonarQube
• OWASP ZAP (open source)

Container Security

• Aqua Security
• Sysdig Secure
• Prisma Cloud Compute
• Trivy (open source)

Secrets Management

• HashiCorp Vault
• AWS Secrets Manager
• Azure Key Vault
• CyberArk

Identity & Access

• Okta
• Auth0
• Azure AD / Entra ID
• Ping Identity
• CyberArk (PAM)

Common Security Workflows

1. Security Incident Response Workflow

1. Detection & Alert
   ↓
2. Triage & Classification
   - Determine severity (P0-P3)
   - Assign to responder
   ↓
3. Investigation
   - Gather evidence
   - Analyze logs (SIEM)
   - Determine scope
   ↓
4. Containment
   - Isolate affected systems
   - Block malicious IPs/domains
   - Disable compromised accounts
   ↓
5. Eradication
   - Remove malware
   - Close vulnerabilities
   - Patch systems
   ↓
6. Recovery
   - Restore from backups
   - Verify system integrity
   - Return to production
   ↓
7. Post-Incident Review
   - Document timeline
   - Root cause analysis
   - Update playbooks
   - Implement improvements
   ↓
8. Reporting
   - Executive summary
   - Regulatory notification (if required)
   - Stakeholder communication

2. Vulnerability Management Workflow

1. Asset Discovery
   - Scan network for assets
   - Maintain asset inventory
   ↓
2. Vulnerability Scanning
   - Authenticated scans
   - Unauthenticated scans
   - Agent-based monitoring
   ↓
3. Assessment & Validation
   - Validate findings
   - Remove false positives
   - Add business context
   ↓
4. Prioritization
   - Apply CVSS + context
   - Assign severity (P0-P3)
   - Create remediation tickets
   ↓
5. Remediation
   - Patch systems
   - Apply compensating controls
   - Update configurations
   ↓
6. Verification
   - Rescan to confirm fix
   - Update vulnerability status
   ↓
7. Reporting
   - Metrics dashboard
   - Executive reports
   - Trend analysis

3. Access Review Workflow

1. Schedule Review (Quarterly)
   ↓
2. Generate Access Reports
   - User access by role
   - Privileged accounts
   - Service accounts
   - Orphaned accounts
   ↓
3. Distribute to Managers
   - Each manager reviews their team
   - Certify appropriate access
   ↓
4. Review & Certify
   - Approve legitimate access
   - Flag inappropriate access
   - Identify orphaned accounts
   ↓
5. Remediation
   - Revoke unapproved access
   - Disable orphaned accounts
   - Update RBAC assignments
   ↓
6. Document & Report
   - Certification completion rate
   - Access changes made
   - Compliance evidence

4. SOC2 Audit Preparation Workflow

1. Scoping (3-4 months before)
   - Define in-scope systems
   - Select Trust Service Criteria
   - Engage auditor
   ↓
2. Gap Assessment (2-3 months before)
   - Map controls to requirements
   - Identify control gaps
   - Create remediation plan
   ↓
3. Readiness (1-2 months before)
   - Implement missing controls
   - Document policies/procedures
   - Conduct mock audit
   ↓
4. Evidence Collection (Ongoing)
   - Automate evidence gathering
   - Organize evidence repository
   - Prepare control narratives
   ↓
5. Audit Kickoff
   - Provide evidence to auditor
   - Respond to requests
   - Schedule interviews
   ↓
6. Fieldwork (4-6 weeks)
   - Auditor tests controls
   - Provide additional evidence
   - Address findings
   ↓
7. Report Issuance
   - Review draft report
   - Address any exceptions
   - Receive final SOC2 report
   ↓
8. Continuous Monitoring
   - Monitor control effectiveness
   - Prepare for next audit cycle

Best Practices

Security Architecture

• Design with security in mind from the start (shift-left)
• Apply defense in depth with multiple security layers
• Implement Zero Trust: verify explicitly, use least privilege, assume breach
• Segment networks and limit lateral movement
• Encrypt data at rest and in transit
• Use secure defaults and fail securely

Access Control

• Enforce multi-factor authentication (MFA) everywhere
• Implement least privilege access
• Use just-in-time (JIT) privileged access
• Regularly review and certify access
• Disable accounts promptly on termination
• Avoid shared accounts and service account abuse

Security Operations

• Centralize logging with SIEM
• Automate detection and response where possible
• Maintain an incident response plan and test it
• Conduct regular threat hunting exercises
• Keep vulnerability remediation SLAs aggressive
• Practice incident response through tabletop exercises

Application Security

• Integrate security into CI/CD (DevSecOps)
• Scan code for vulnerabilities (SAST, DAST, SCA)
• Follow OWASP Top 10 guidelines
• Conduct security code reviews for critical changes
• Implement secure API design (authentication, rate limiting, input validation)
• Use security headers (CSP, HSTS, X-Frame-Options)

Cloud Security

• Use infrastructure as code (IaC) with security scanning
• Enable cloud-native security services (GuardDuty, Security Hub)
• Implement CSPM to monitor misconfigurations
• Use cloud-native encryption and key management
• Apply least privilege IAM policies
• Monitor for shadow IT and unauthorized resources

Compliance

• Treat compliance as a continuous process, not one-time
• Map controls to multiple frameworks for efficiency
• Automate evidence collection where possible
• Maintain a compliance calendar for deadlines
• Document everything (if it's not documented, it doesn't exist)
• Conduct internal audits before external audits

Security Culture

• Make security everyone's responsibility
• Conduct regular security awareness training
• Run phishing simulations to test awareness
• Reward security-conscious behavior
• Create clear, accessible security policies
• Foster a culture where reporting security concerns is encouraged

Integration with Other Disciplines

With DevOps/Platform Engineering

• Integrate security scanning into CI/CD pipelines
• Automate security testing and compliance checks
• Implement Infrastructure as Code (IaC) security
• Use container scanning and runtime protection
• Coordinate on incident response for production issues

With Enterprise Architecture

• Align security architecture with enterprise architecture
• Participate in architecture review boards
• Ensure security requirements in architecture standards
• Design secure integration patterns
• Define security reference architectures

With IT Operations

• Coordinate on patch management and change control
• Collaborate on monitoring and alerting
• Joint incident response for security and operational incidents
• Align on backup and disaster recovery procedures
• Coordinate access management and privileged access

With Product Management

• Provide security requirements for new features
• Participate in threat modeling for new products
• Balance security with user experience
• Advise on privacy and compliance implications
• Support security as a product differentiator

With Legal/Privacy

• Coordinate on data privacy regulations (GDPR, CCPA)
• Collaborate on breach notification requirements
• Review vendor contracts for security terms
• Support privacy impact assessments
• Align on data retention and deletion policies

When to Engage Security & Compliance

Required Engagement

• New system or application design
• Architecture changes affecting security boundaries
• Regulatory compliance initiatives
• Security incidents
• Vendor risk assessments
• Pre-production security reviews
• Audit preparation
• Data breach or suspected breach

Recommended Engagement

• Major feature releases
• Cloud migrations
• M&A due diligence
• Infrastructure changes
• New third-party integrations
• Significant process changes
• Security tool selection
• Policy updates

Continuous Collaboration

• Security review of pull requests (for critical systems)
• Vulnerability remediation prioritization
• Security awareness and training
• Threat intelligence sharing
• Risk assessment updates
• Compliance monitoring