Managing security evidence in safety-critical organizations

Mazen Mohamad, Jan-Philipp Steghöfer, Eric Knauss, Riccardo Scandariato

Abstract: Highlights•Current maturity levels for managing security evidence are low.•Artifacts are not recognized as evidence and managed as other development artifacts.•An organizational-level framework for managing security evidence is missing.•Effective management of security evidence requires considering the human aspect.•Supplier–customer relationships require a common language for security assurance.