LOGBOOK

HELP

Quiz Entry - updated: 2026.10.13

How is each secure development phase described, and who is accountable in every one of them?

Every phase has a goal, deliverables, prerequisites, a RACI line, five steps, and dos and don'ts. The Product Owner is Accountable in all ten.

RACI splits ownership of a task four ways:

  • Responsible does the work.
  • Accountable owns the outcome and signs off. There is exactly one.
  • Consulted gives input before the work is done (two-way).
  • Informed is told the result (one-way).

The deck adds Supporting for roles that help with the work. Making the Product Owner accountable everywhere is deliberate. Security then becomes a property of the product, owned by the person who owns the product, and not a side task of the security team. The Responsible role moves from phase to phase:

Phase Responsible
1 Planning & classification Project Lead
2 Security requirements Requirements Manager
3 Threat analysis & risk assessment Product Security
4 Architecture & design Architect
5 Secure sourcing Project Lead
6 Secure implementation Developer
7 Security testing Test Manager
8 Security documentation Project Lead
9 Security certification Project Lead
10 DevSecOps Developer

Go deeper:

From Quiz: SPREN1 / Secure Development Phases: Classification to DevSecOps | Updated: Oct 13, 2026