Governance, Training & Secure Development¶

This template is the starting point for four practices your organization owns: executive sponsorship of the security program, the security investment review that follows from it, cybersecurity education and training, and the security and privacy work built into the software development lifecycle and the cloud-native architecture of the offering. These are governance, HR, and engineering practices. Fill in the sample sections with what your organization actually does, then keep the review outcomes recorded so the evidence matches the practice.

Download the KB article (Markdown)

Requirements this document answers¶

Key Security Indicators only. No FedRAMP Rule (FRR) in the 2026 Consolidated Rules names a governance, training, or secure development document; the obligation is the KSI outcome.

Policy and Inventory¶

Related: KSI-CNA-IBP (Implementing Best Practices - "The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance.") is answered by the Supply Chain Risk Template, which owns third-party resource configuration comparison.

Related: KSI-PIY-RVD (Reviewing Vulnerability Disclosures) is answered by the Vulnerability Disclosure Program Template, which owns the program's design, intake, and effectiveness review.

Cybersecurity Education¶

Cloud Native Architecture¶

Sample practice: executive support and security investment¶

Sample text. [Organization]'s security goals are set annually by [executive role] and endorsed by [governing body: security steering committee, executive leadership team, board committee]. The governing body meets [cadence], and its standing agenda covers progress against each goal, the security investments funded in the current period, and the outcomes those investments produced. Minutes record attendance, decisions, and the funding actions taken; they are the demonstration of executive support, not a summary of it.

Sample text. Security investment effectiveness is reviewed [cadence] by [role] against [measures: risk reduction observed, incidents avoided or contained, validation pass rates, audit and assessment findings closed, time-to-remediate trends]. The review states, per material investment, what was spent, what changed, and whether the investment continues. Investments that produced no measurable change are either redirected or discontinued with the reason recorded.

Replace with your practice. Name the governing body, its cadence, and the measures. KSI-PIY-RES asks for support that is reviewed and demonstrated, so name the artifact that demonstrates it.

Sample practice: cybersecurity education and training¶

Sample text. [Organization] runs four training tracks. All employees and contractors complete general security awareness training within [period] of hire and [cadence] thereafter. Employees in high risk roles, defined as [role list], complete role-specific training [cadence]. Development and engineering staff complete secure software delivery training [cadence], covering [topics]. Staff with incident response or disaster recovery duties complete their role training [cadence] and participate in the exercise program. Completion is tracked in [system]; overdue completions escalate to [role].

Sample text. Training effectiveness is reviewed [cadence] by [role] using [measures: assessment scores, phishing simulation click and report rates, incidents attributable to a training gap, exercise performance]. The review adjusts content and cadence where a measure moves the wrong way. Content is refreshed [cadence] and on any material change to the threat picture or the offering.

Replace with your practice. KSI-CED-RAT enumerates four minimum audiences. Cover all four explicitly, and name the effectiveness measures: completion rates alone are attendance, not effectiveness.

Sample practice: security in the software development lifecycle¶

Sample text. Security and privacy requirements enter [Offering]'s development lifecycle at [entry points: design review, threat model, requirement intake]. Every change passes [gates: peer review, static analysis, dependency scanning, secret scanning, infrastructure-as-code policy checks] before merge, and [gates: dynamic analysis, pre-production validation] before release. Threat models are produced for [scope] and revisited on material design change. The program is aligned to CISA Secure By Design principles, with [named practices] carrying that alignment; the alignment is reassessed [cadence].

Sample text. SDLC effectiveness is reviewed [cadence] by [role] using [measures: defects caught pre-release against defects found in production, gate bypass count and reason, mean time to remediate findings by severity, coverage of the automated gates across repositories]. Findings drive changes to the gates rather than exceptions to them.

Replace with your practice. Name the real gates and where they run. KSI-PIY-RSD asks for the effectiveness of the practice to be reviewed, so name what you measure.

Sample practice: cloud-native architecture reviews¶

Sample text. [Offering]'s architecture is reviewed [cadence] against six standing questions, one per indicator. Functionality and privileges for each infrastructure component and service are declared in [location] and enforced through [mechanism] (KSI-CNA-DFP). Attack surface and lateral movement exposure are assessed using [method], with segmentation enforced by [mechanism] (KSI-CNA-MAT). High availability and recovery posture is assessed per service tier against the objectives in the Recovery Planning Template (KSI-CNA-OFA). Inbound and outbound traffic restrictions are compared against the declared intent using [tooling] (KSI-CNA-RNT). Denial of service and unwanted activity protections are tested for effectiveness using [method] (KSI-CNA-RVP). Logical networking constructs enforcing traffic flow control are inventoried and reviewed (KSI-CNA-ULN). Each review records what was examined, what failed, and the corrective actions with owners and due dates.

Replace with your practice. Name the tooling and mechanism per question. Where a review is automated, say which check performs it; where it is a documented human review, say who performs it and how often.

Organization-defined values¶

Evidence¶

The GRC-ITSM platform does not hold your steering committee, deliver your training, or run your build pipeline. It evidences that these indicators are being met, through scheduled machine checks against the offering's architecture and validation records for the governance and training reviews. See the Continuous Monitoring and Reporting Policy and Procedures for the validation tree and the check cadences.

Authority, review, and revision¶

Client fills. Name the executive who issues this document, the roles that own each of the four practices, the review cadence, and the approval path for exceptions. Record the issue date and the revision history below.