Quiz Entry - updated: 2026.10.13
How is each secure development phase described, and who is accountable in every one of them?
Every phase has a goal, deliverables, prerequisites, a RACI line, five steps, and dos and don'ts. The Product Owner is Accountable in all ten.
RACI splits ownership of a task four ways:
- Responsible does the work.
- Accountable owns the outcome and signs off. There is exactly one.
- Consulted gives input before the work is done (two-way).
- Informed is told the result (one-way).
The deck adds Supporting for roles that help with the work. Making the Product Owner accountable everywhere is deliberate. Security then becomes a property of the product, owned by the person who owns the product, and not a side task of the security team. The Responsible role moves from phase to phase:
| Phase | Responsible |
|---|---|
| 1 Planning & classification | Project Lead |
| 2 Security requirements | Requirements Manager |
| 3 Threat analysis & risk assessment | Product Security |
| 4 Architecture & design | Architect |
| 5 Secure sourcing | Project Lead |
| 6 Secure implementation | Developer |
| 7 Security testing | Test Manager |
| 8 Security documentation | Project Lead |
| 9 Security certification | Project Lead |
| 10 DevSecOps | Developer |
Go deeper:
Responsibility assignment matrix (Wikipedia) — RACI and its variants, with the one-accountable rule