A security champions charter is a one page agreement that states why the program exists, what champions do, how much time they get, what they can decide, and how the program is reviewed. Writing it down is what turns a good intention into something managers can protect.
Why a charter
OWASP's guide lists "Start with a clear vision for your program", "Secure management support" and "Nominate a dedicated captain" among its ten principles. A charter records all three in one place, signed by someone with authority. It also protects champions from drifting duties.
The template
Copy this and fill in the brackets.
1. Purpose. We run a security champions program so that each team has a named person who connects it with the security group. We expect [outcome], measured by [two metrics].
2. Scope. Teams in scope: [list]. Out of scope for now: [list].
3. Roles.
| Role | Who | Responsibility |
|---|---|---|
| Sponsor | [Name] | Protects time, removes blockers |
| Captain | [Name] | Runs meetings, tracks activity, reports |
| Champion | One per team | Triage, review, teaching, escalation |
| Security group | [Team] | Standards, tooling, escalation target |
| Manager of champion | [Name] | Protects time, credits the work |
4. Time. Each champion gets [number] hours a week of protected time, on the calendar.
5. Activities. Weekly triage of findings; participation in reviews of high risk changes; attendance at a [monthly] briefing; one short teaching item per quarter.
6. Decisions. Champions may: mark findings real or false with a reason, set urgency within policy, request a review. Champions may not: approve risk acceptance, change scanner rules, or hold up a release alone.
7. Training. Each champion receives [training plan], and an annual budget of [amount or hours].
8. Recognition. Champion work appears in performance documents, and the program publishes thanks each [quarter].
9. Term and succession. Terms last [length], renewable. Each champion names a backup.
10. Review. The charter is reviewed on [date] each year by the sponsor and captain.
Tips
- Keep it to one page. If it grows, nobody reads it.
- Get the sponsor's signature in writing.
- Send it to every champion's manager.
- Link it from the team wiki and the onboarding checklist.
- Show it to new champions on day one.
What to do when it is ignored
If time is not protected, raise it at the review with data: hours used against hours promised. If duties drift, point to section 6. A charter is only useful if people refer to it.
Where Safeguard fits
Safeguard provides policies, gates and guardrails and compliance evidence automation, which can back the decisions a charter describes. A free scan is available.
Quick check
Does a small company need a charter?
A half page is enough, but write it. Even three developers benefit from knowing who decides what.
Who should sign it?
The sponsor, usually an engineering or security leader who can protect time and budget.
Sources
Last reviewed: 19 October 2026.
