NIST SP 800-218, the Secure Software Development Framework (SSDF), is a set of outcome-based practices that reduce vulnerabilities and supply-chain risk in any development life cycle. This free course explains its four practice groups, tasks and references, risk-based adoption, evidence and attestation, the Version 1.2 draft, and a worked example.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
OWASP SAMM (version 2, current model release 2.2.0) is a free, open maturity model for measuring and improving software security practices across governance, design, implementation, verification and operations. This free course explains its practices, streams and maturity levels, how to run an assessment and calculate scores, how to set risk-based targets and roadmaps, and how SAMM relates to BSIMM, NIST SSDF, ASVS and ISO/IEC 27001.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
BSIMM is an observational model that benchmarks software security initiatives using data from more than a hundred real organisations. This free course explains the four domains, twelve practices and 128 activities of BSIMM16, how activity levels work, how assessments and scorecards are built, and how to use the results to plan improvements.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
The OWASP Application Security Verification Standard (ASVS) is a free catalogue of testable security requirements for web applications and APIs. This free course explains version 5.0.0: its 17 chapters, the three verification levels, documented security decisions, tailoring, how to verify and report, and how ASVS fits with other OWASP projects, with a worked example.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
OWASP MASVS (current release v2.1.0) is the free, open standard for the security and privacy of mobile apps on Android and iOS. This free course explains its eight control groups, the MAS testing profiles L1, L2, R and P, how MASVS links to MASWE and MASTG, how to verify an app and report honestly, and how MASVS relates to ASVS and the Mobile Top 10.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
SAFe, the Scaled Agile Framework from Scaled Agile, Inc., coordinates many agile teams from team to portfolio. Learn its core values and Lean-Agile principles, configurations and disciplines, the Agile Release Train and its roles, PI Planning and Inspect and Adapt, WSJF and Lean Portfolio Management, how certification works and the pitfalls to avoid.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
Scrum is a lightweight agile framework, defined by the 2020 Scrum Guide, in which a small self-managing team delivers value in short Sprints and adapts from evidence. Learn its theory and values, the three accountabilities, five events and three artifacts with their commitments, how to run a Sprint, how certification works, and the pitfalls to avoid.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
The Kanban Method, maintained by Kanban University, is a way to manage and improve knowledge-work services by visualising work, limiting work in progress and improving flow in small agreed steps. Learn its principles and six general practices, board and WIP-limit design with STATIK, classes of service, cadences, flow metrics and Little's Law, credentials and the Kanban Maturity Model, and common pitfalls.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
ISO/IEC 38507:2022 is the international guidance standard on what an organisation's use of artificial intelligence means for its governing body and its accountability. This free course explains governance versus management of AI, how AI systems differ from other IT, the policy areas for oversight, decisions, data, values, compliance and risk, and how it fits with ISO/IEC 38500 and ISO/IEC 42001.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.
ISO/IEC 23894:2023 is the international guidance standard for managing AI-related risk, built on ISO 31000. This free course explains its principles, framework and process, the AI objectives, risk sources and life cycle annexes, how to assess and treat the risks of a real AI system, and how it relates to ISO/IEC 42001, the NIST AI RMF and the EU AI Act.
Free course: a 60-minute tutorial with diagrams, a 25-question knowledge check and a certificate you can verify online.