The following process overview schematic is derived from IBM's Security in Development The IBM Secure Engineering Framework, but I think I've seen a very similar process diagram before, though I cannot find it or remember it. Would this IBM Security and Privacy by Design (SPbD) process be based on an existing standard or guideline, e.g., one from NIST or ISO? It is a fairly sensible process so I would not be surprised if a similar process has been drawn before.

Security and Privacy by Design

  • The diagram is not rocket science. Risk assess > design tests for risks > manage tests > manage fixes > release. This is a very basic flow of processes used for, well, anything. From software QA to secure coding to financial risks.
    – schroeder
    Dec 5, 2022 at 13:10

1 Answer 1


As it is stated in IBM's site, SPbD is aligned with NIST's Secure Software Development Framework (SSDF). As such, you may find similarities among SPbD and others, that are aligned with NIST's SSDF.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .