Put security checks that apply to every change in the definition of done, and checks that depend on what one story does in its acceptance criteria. The definition of done is shared and constant. Acceptance criteria are written per story. Mixing them up leaves either gaps or a checklist nobody reads.
Two lists, two jobs
The Scrum Guide defines the Definition of Done as a formal description of the state of an increment when it meets the quality measures required for the product. An item that does not meet it cannot be released, or even shown at the sprint review. It goes back to the backlog.
Acceptance criteria are not defined by the Scrum Guide. Teams use them to describe what must be true for one backlog item to be accepted. They change with every story.
| Definition of done | Acceptance criteria | |
|---|---|---|
| Scope | Every item | One item |
| Written by | Whole team, reviewed over time | Product owner with the team, at refinement |
| Changes | Rarely | Every story |
| Security example | Dependency scan has no new blocking findings | Only the account owner can export this report |
What belongs in the definition of done
These are checks you want on every change, run the same way each time and, where possible, by a tool.
- Peer review completed by someone other than the author.
- Static analysis and dependency scan ran with no unresolved blocking findings.
- No secrets in the diff.
- Security-relevant logging does not record credentials or personal data.
- Any new dependency has a named owner.
NIST's Secure Software Development Framework gives this a direct nod. Practice PO.4.1 asks organizations to define criteria for software security checks and track them across the lifecycle, and one of its examples is adding software security criteria to existing checks such as the Definition of Done in agile methods.
What belongs in acceptance criteria
These depend on the story's behavior. Write them as observable statements a tester can check.
- A user without the editor role gets a denial when they call the update endpoint.
- The password reset link stops working after one use.
- Uploading a file over the size limit returns an error and stores nothing.
- The new admin screen appears in the audit log with the actor and action.
If you cannot test a criterion, rewrite it until you can.
How to decide which list a check goes in
- Ask "would I want this checked on every story?" If yes, definition of done.
- Ask "does it depend on what this story does?" If yes, acceptance criteria.
- If it is a one-off, such as a pen test of a new payment flow, make it a separate backlog item.
- Review the definition of done after each security issue and ask whether a line should be added.
Keep the definition of done short
A definition of done with 25 items trains people to tick boxes. Aim for under ten lines, and automate what you can so the tick is a pipeline result, not a promise. A check that is skipped under deadline pressure is a sign it belongs in the pipeline, where a failed check blocks the merge.
When the two disagree
If a story passes its acceptance criteria but fails the definition of done, it is not done. The Scrum Guide is clear that an item below the definition of done goes back to the backlog. Hold that line for security items too, or the definition becomes a suggestion.
Safeguard can enforce dependency and policy gates on pull requests, so parts of a security definition of done run automatically. A free scan is available at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a failed check blocks the merge, which is what turns a definition of done line into a real control.
Quick check
Can the same security check appear in both lists?
It should not. If a check applies to every story it lives in the definition of done. If it depends on the story, it lives in that story's acceptance criteria.
Who owns the definition of done?
The team that does the work. The Scrum Guide ties the developers to instilling quality by adhering to it. Security can advise on what to add.
Sources
Last reviewed: 19 October 2026.
