Build a secure development skills matrix by listing six to ten security topics your teams need, defining three skill levels in plain words, rating each team rather than each person at first, and using the gaps to plan training and coverage. Keep it to one page and review it twice a year.
What a matrix gives you
Training plans usually start from a course catalogue. A matrix starts from your needs. It shows where knowledge is deep, where it rests on one person and where nobody has it. It also helps with hiring, rotation and deciding who reviews what.
NIST SP 800-50 Rev. 1 describes a lifecycle approach to building a learning program, including metrics and evaluation. A matrix is a simple, practical piece of that cycle.
Step 1: choose topics
Pick topics from what your teams actually build. A typical set:
- Authentication and authorization
- Input handling and injection
- Secrets and credential handling
- Dependency and package choice
- Secure design and threat modeling
- Logging and monitoring
- Pipeline and deployment security
- Incident response basics
Do not copy a long list. Eight well chosen topics are easier to keep alive than thirty.
Step 2: define three levels
| Level | Meaning |
|---|---|
| Aware | Can explain the topic and recognise a problem |
| Practising | Applies the right pattern in their own work without help |
| Guiding | Can review others' work and teach the topic |
Write a one line example for each level per topic. Without examples, everyone rates themselves differently.
Step 3: rate by team first
Rating individuals can feel like a performance review, and people may inflate or avoid it. Start with team level ratings agreed in a short conversation among leads. Add individual self assessment only if people want it and the purpose is clearly development, not evaluation.
Step 4: read the gaps
Look for three patterns:
- No one at Guiding. A topic with no teacher. Plan external learning or hire.
- One person at Guiding. A single point of failure. Pair them with someone.
- Aware only on a high risk topic. A priority gap. Schedule training first here.
Keeping it useful
- Review twice a year, and after big changes in your stack.
- Tie each gap to one action with an owner.
- Compare against your findings. If authorization bugs keep appearing but the matrix says teams are Practising, the self view is optimistic.
What to avoid
Do not use the matrix for pay or promotion decisions. Do not publish individual cells. Do not let it turn into a spreadsheet nobody opens. If a quarter passes without a decision based on it, simplify it.
Where Safeguard fits
Compare the matrix with real data. Safeguard's vulnerability management views and compliance evidence automation can show which categories recur. It does not offer training courses. A free scan is at gold.safeguard.sh/scan.
Quick check
How many topics should a skills matrix have?
Six to ten. Beyond that it becomes hard to maintain and to act on.
Should individuals see each other's ratings?
Generally no. Share team level results and keep individual views private to the person and their manager.
Sources
- NIST SP 800-50 Rev. 1: csrc.nist.gov/pubs/sp/800/50/r1/final
Last reviewed: 19 October 2026.
