To get management support, ask for specific, small commitments: protected time for champions, a named program owner and a short quarterly report. Leadership backing is a recurring theme in the guidance. OWASP lists securing management support as a principle for champions programs, and CISA's Secure by Design principles include leading from the top.
What the sources say
The OWASP Security Champions Guide lists "secure management support" as one of its ten principles. The CISA Secure by Design page names three principles: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top. The page describes the third as senior leadership driving secure-by-design commitments.
Those frames differ, but the point is the same: programs without a sponsor tend to lose every argument about time.
Ask for three things
- Time. A fixed slice of calendar time for champions and design reviews, written into team plans.
- An owner. One named person accountable for the program, with some of their time officially assigned.
- A rhythm. A short report each quarter, so the sponsor stays informed.
Avoid asking for budget first. Time and ownership cost less to approve and show whether the program works.
Speak the sponsor's language
Translate security work into things leaders already track:
- Fewer late surprises before a release.
- Faster answers to customer security questions.
- Less rework from design problems found after launch.
- Clear ownership when something goes wrong.
Do not quote statistics you cannot source. Use examples from your own team, with names removed if needed.
Bring a small pilot
Offer to run a pilot with three teams for a quarter. Define what you will report at the end: teams participating, sessions held, changes made. A pilot is easier to approve than a program.
Report honestly
Include what did not work. A sponsor who hears only good news will stop believing the reports. Show open risks, accepted risks and what you need next.
Keep support alive
Invite the sponsor to one champions meeting a quarter. Recognize the sponsor when the program helps a launch. Ask for feedback.
A one page pitch
Open with the problem in one sentence from your own experience. State the three asks: time, owner, rhythm. Describe the pilot: three teams, one quarter. List what you will report: teams involved, sessions held, changes made, open risks. Close with what you need decided today. One page, plain words, no jargon, and a leader can say yes or no in a meeting.
Quick check
What if leadership says no?
Start smaller within your own authority: a threat modeling session for one risky feature. A concrete result gives you something to show.
Do I need metrics before asking?
No. Ask for a pilot and agree on what you will measure together.
Sources
Last reviewed: 19 October 2026.
