1) Define scope and security ownership

• Identify applications, services, pipelines in scope.
• Assign roles:
  • Security (policies, risk)
  • Engineering (implementation)
  • DevOps (pipeline integration)
• Define responsibility model (shared vs centralized security).

2) Establish security baseline (foundational)

• Define:
  • Secure coding standards
  • Dependency policies
  • Infrastructure hardening standards
• Create threat models per application/service.
• Classify data (sensitive, internal, public).

3) Integrate security into source control

• Enforce:
  • Branch protections
  • Mandatory code reviews
• Add pre-commit hooks:
  • Secret detection
  • Linting for insecure patterns

4) Embed security in CI/CD pipeline

Shift-left approach

Add automated stages:

• SAST (Static Analysis)
  • Scan code for vulnerabilities during build
• SCA (Dependency scanning)
  • Detect vulnerable libraries
• Secrets scanning
  • Prevent credential leaks