G.4.1 Role-based training
Control Details
Objective
Provide security training for all personnel involved in software development
Definition
Provide literacy and role-based training on software security and secure software supply chain. This training should include information about the firm's security culture, the secure software development lifecycle, containerization and security orchestration, common security mistakes, technology such as CI/CD, AI models, and DevSecOps, and recognizing insider threat. Require this training as part of onboarding and periodically.
Assessment Questions
- Describe the training given to employees and to vendors related to software supply chain security?
- Describe your process for scheduling and monitoring team member training in secure software architecture, design, development, testing, and software supply chain management.
- How do you customize the training specific to team roles, development tools, and languages?