{
  "uid": "cogitave.learn.secure-sdlc.summary",
  "kind": "moduleUnit",
  "href": "/modules/secure-sdlc/summary/",
  "title": "Summary",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "Next steps"
  ],
  "source": "You can now build with the secure SDLC: you know the baseline of controls a\nCogitave product carries, and the lifecycle that turns them into a gate at each\nstage.\n\nIn this module, you:\n\n- Separated the **controls** the Security Standard owns - IAM for humans,\n  workloads, and agents, secrets and PKI, security operations, and threat\n  modeling - from the **process** the Secure Development Lifecycle Standard\n  owns.\n- Learned the baseline: **secure-by-design and secure-by-default**, least\n  privilege, and IAM, enforced by in-repo controls (CODEOWNERS, rulesets,\n  gitleaks, signed commits, push protection).\n- Mapped **security as a gate** onto each lifecycle stage - a STRIDE threat model\n  at the design gate, SAST and secret-scan at implement, the test tiers at\n  verify, SBOM and signing at release, and exploit-aware (CVSS x EPSS)\n  remediation SLAs after.\n- Saw the two Definition-of-Done gates - **S1** (threat-model-reviewed) and **S2**\n  (no new High or Critical) - that make the lifecycle enforceable per change, and\n  that security is a builder-owned automated gate, not an end-of-line team.\n\n## Next steps\n\n- @cogitave.learn.ci-cd-pipelines - the next module in **Cogitave\n  engineering standards**, on the pipeline that carries these gates from pull\n  request to production.\n- The **Secure Development Lifecycle Standard** is the canonical process, in\n  the estate's standards repository, including the full SDL-to-lifecycle\n  table, the testing tiers, and the OWASP LLM Top 10 coverage.\n- **ADR 0020** is the estate's decision behind why security-by-design with\n  STRIDE as the default was chosen over a security-as-team model, if you want\n  the reasoning.\n",
  "partOf": "cogitave.learn.secure-sdlc",
  "durationInMinutes": 3,
  "quiz": null
}