A Scrum Master does not own security decisions. They protect the conditions that let the team do secure work: a definition of done that is honored, blockers removed quickly, and events that leave room for security topics. Think of the role as a facilitator of the team's habits, not an auditor.
What the Scrum Guide gives the role
The Scrum Guide says the Scrum Master helps the team focus on creating increments that meet the Definition of Done, causes the removal of impediments, and ensures Scrum events take place and stay positive, productive and within the timebox. It also says they coach the team in self-management.
Every one of those has a security use.
| Scrum Master duty | Security use |
|---|---|
| Keep increments within the definition of done | Notice when security lines are skipped and raise it |
| Remove impediments | Chase a slow security review or a missing access request |
| Make events happen | Make sure retros and refinement touch security |
| Coach self-management | Help the team own its security checks |
Five concrete things to do
- Watch the definition of done. If a security line is routinely waived, say so in the retrospective. A waived line is a sign it is wrong or unowned.
- Treat a blocked security review as an impediment. If a story waits days for a design review, that is the Scrum Master's problem to unblock.
- Add one security question to refinement. For example, "does this change what data we hold?" Keep it to a single line.
- Put one security prompt in each retrospective. The Guide says the retrospective inspects processes, tools and the definition of done, so a security prompt fits.
- Bring in the security champion or team when needed. The Scrum Master connects people without becoming the expert.
What a Scrum Master should not do
- Act as the security gatekeeper. That mixes facilitation with approval.
- Decide risk acceptance. That sits with the product owner and the right manager.
- Write security policy for the team.
- Run security testing.
If a Scrum Master is also the team's de facto security person, name that as a second hat so people know which one is speaking.
A simple retrospective prompt set
Rotate one of these each sprint:
- Which security check did we skip or rush, and why?
- What did we learn from the last scan result?
- Was any story blocked waiting on security? For how long?
- What would we add to the definition of done?
The Scrum Guide says the retrospective plans ways to increase quality and effectiveness. Security questions are quality questions, so they belong there without special pleading.
Measuring whether it helps
Track two things: the number of days security-related stories wait on others, and how many sprints pass before a skipped definition-of-done line is fixed or removed. Falling numbers mean the conditions are improving. Do not use them to compare individuals.
Connecting to the wider framework
NIST's Secure Software Development Framework asks organizations to define SDLC roles and review them over time. A Scrum Master's security duties are a small part of that picture. Write them down in a sentence or two, so nobody assumes the role holds more authority than it has.
Safeguard provides policy gates and compliance evidence automation that can make definition-of-done checks visible to the team. A free scan is at gold.safeguard.sh/scan.
Quick check
Is the Scrum Master the security lead?
No. The role facilitates the team's process and removes impediments. Security expertise comes from the team, a champion or a security group.
What is the easiest first step?
Add one security prompt to the sprint retrospective and track whether it leads to a change in the definition of done.
Sources
Last reviewed: 19 October 2026.
