Bringing the Dawn of Security & Compliance to Project Teams
summary
A lightweight, org-wide 14-question assessment lives in an emailed Excel workbook, uses a non‑linear (Fibonacci) scoring scale, and feeds a database to produce spider charts of residual risk for each project and account. Teams run an initial assessment ~20 days after project creation, quarterly checkpoints, and pre-delivery reviews; quality teams coach and validate scores and push action items into ticketing. Deployment scales to monthly intake and shifts PMs from scope/time/cost focus to measurable security and compliance risk management, and it reduces untracked technical debt.
AI-written summary · about
chapters (9)
- 0:00Security compliance introduction
- 3:12Project manager’s limited view
- 10:49Lightweight risk assessment framework
- 20:58Audits and maturity models failed
- 23:1014-question assessment
- 31:26Governance and continuous assessment
- 37:09Security risk assessment factors
- 42:35Benefits for managers and company
- 44:40Conclusion and insights
related talks
54mScaling Security in Agile Scrum
51mThe Overlooked Security Risk: 3rd Party Risk Management
43mDeveloper Driven Security In High-Growth Environments
25mOWASP DevSecOps Maturity Model (DSOMM)
44mMaturing SDLC At A Fortune 500 Company Based On OWASP SAMM: Successes And Pitfalls
01h 00mSAMM Project
52mLeveraging Psychological Needs For Building A Security Culture Amongst Developers
43mBuilding a Secure DevOps Pipeline