Which stakeholders need to be involved in product security, and for what?

R&D leadership, product owners, project leaders, architects and developers, testing (V&V), quality and GRC, legal, IT, production management and customer support. Each one owns part of the lifecycle.

• R&D leadership: priorities, budget and the secure development process.
• Product owners: accountable for the product's security, deciding trade-offs.
• Project leaders: plan security activities and resources into the project.
• Architects and developers: secure design and implementation.
• V&V / testing: security test cases, pentests, traceability.
• Quality and GRC: process compliance, audits, certifications.
• Legal: laws per market, contracts with suppliers, liability, disclosure.
• IT: a secure development and build infrastructure.
• Production management: secure manufacturing and key provisioning.
• Customer support: receives vulnerability reports and incidents from the field, and passes advisories and patches to customers.

Product security is a cross-functional task. Missing one stakeholder leaves a gap in the lifecycle, for example no secure key injection in production, or no route for a customer's vulnerability report.