Software Engineering Institute

Software is a growing component of modern business- and mission-critical systems. As a result, software assurance is becoming increasingly important to organizations across all sectors. A key aspect of software assurance is keeping security and resilience risks within an acceptable tolerance across the systems lifecycle. The Security Engineering Framework (SEF) is a collection of software-focused engineering practices for managing security and resilience risks across the systems lifecycle. It provides a roadmap for building security and resilience into software-reliant systems and maintaining the system’s security/resilience capabilities during operations and sustainment (O&S). SEF practices help ensure that engineering processes, software, and tools are secure and resilient, reducing the risk that attackers will disrupt program and system information and assets. Acquisition programs can use the SEF to assess their current security/resilience engineering practices and chart a course for improvement, ultimately reducing security/resilience risks in deployed software-reliant systems. The SEF organizes practices into a hierarchy of goals and domains and provides in-depth guidance for all goals and practices. SEF guidance describes the capability represented by each goal and provides an elaboration of each practice in the framework. This report provides a detailed description of the SEF, including its organizing structure, practices, and guidance.