In days 61 to 90, turn tuned checks into gates on new issues, write the minimum policy set, publish a few metrics, and review progress with leadership. End the quarter with a plan for the next one. The aim is a program that continues without you pushing every week.
Make gates real
By now noise is tuned. Switch your highest value checks to block newly introduced severe issues, such as a leaked secret or a dependency with a known exploited vulnerability. Leave older debt on a fix schedule. Provide a clear exception route with an expiry date.
Write minimum policy
Short beats thorough. Four documents cover most needs:
| Document | Contents |
|---|---|
| Secure development standard | Review, testing and release rules |
| Vulnerability handling | Targets, owners, exceptions |
| Third party and open source use | Approval and monitoring of dependencies |
| Incident reporting | Who to tell and how fast |
NIST SP 800-218 is a good vocabulary source when you need to name practices, and it lets customers map your rules to a recognised reference.
Publish a few metrics
Pick three or four numbers and show them monthly:
- Open severe findings and their age.
- New findings versus closed findings per week.
- Share of repositories with automated scanning.
- Time to fix a known exploited issue.
Avoid a dashboard of thirty tiles. See measuring AppSec program effectiveness.
Review with leadership
Prepare a single page: where we started, what changed, what is still open, what we need. Ask for one concrete decision, for example time for champions or agreement on fix targets. CISA's Secure by Design guidance names leading from the top as a principle, and a visible leadership decision is the practical form of it. For framing, see getting management support.
Plan the next quarter
Choose two themes. Examples: extend scanning to the remaining repositories, add container image checks, start threat modeling for the two riskiest services. Resist the urge to take on five.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch what happens to a pull request that breaks the rule. That is the gate you are switching on in this phase.
Quick check
Do we need formal policy at 90 days?
You need a short written version of the rules you already follow. Formal approval processes can mature later.
Which metric matters most?
Age of open severe findings. It shows whether fixes actually happen.
Safeguard offers policies, gates and guardrails, plus compliance and evidence automation to keep records current. Try a free scan to see findings against a baseline.
Sources
- NIST SP 800-218, Secure Software Development Framework v1.1. Paraphrased.
- CISA Secure by Design principles. Paraphrased.
Last reviewed: 19 October 2026.
