Hi everyone

I was just wondering what security artefacts would projects need to deliver as part of your project / programme frameworks.

Feeling recently that security is slowing becoming an after thought or that it’s just pen testing and vulnerability scanning

In our current framework four phases 1) initiate , 2) plan (requirements) 3) execute 4) control and closure

During these phases Info Sec feed into other teams architecture , BAs and PMs and testing but it’s more info sec going then rather than then updating info sec also in the framework there are no Info Sec artefacts besides vuln or pen testing reports just feeding into other docs.

My plan was to change this to have a weekly drop in session projects can book to engage info sec. Then on the framework the below artefacts 1) initiate - initial risk assessment and business impact analysis

2) plan- systems security plan / information assurance document (how the system will be secured and focus on CIA triad), DR / contingency plan

3) execute - final approved copies of above documents, evidence of executed tests and DR manuals

Is this a good starter for ten? Or anything else that would be needed?