Is IBM's "Security and Privacy by Design" practices based on any earlier standard or guideline?

Question

The following process overview schematic is derived from IBM's Security in Development The IBM Secure Engineering Framework, but I think I've seen a very similar process diagram before, though I cannot find it or remember it. Would this IBM Security and Privacy by Design (SPbD) process be based on an existing standard or guideline, e.g., one from NIST or ISO? It is a fairly sensible process so I would not be surprised if a similar process has been drawn before.

Answer 1

As it is stated in IBM's site, SPbD is aligned with NIST's Secure Software Development Framework (SSDF). As such, you may find similarities among SPbD and others, that are aligned with NIST's SSDF.