UK flag UK
+44 (0) 207 874 5000
+44 (0) 207 874 5000

SecDevOps Foundation® (SDOF) Certification Training

Course 3695 Advantage Plan Course

  • Duration: 3 days
  • Labs: Yes
  • Exam Voucher: Yes
  • Language: English
  • Level: Intermediate

Secure DevOps (SecDevOps) represents the evolution of DevOps toward a security-first software engineering approach. Building upon guidance from the U.S. Department of Homeland Security (DHS), the NIST Secure Software Development Framework (SSDF), and modern DevOps practices, SecDevOps integrates security throughout the entire software lifecycle—including today's AI-enabled applications.

 Consequently, SecDevOps has become the “go to” methodology for organizations writing high-assurance programs, especially for government agencies, defense contractors, financial institutions, healthcare organizations, critical infrastructure providers, and any organization developing security-sensitive software. It provides an excellent operational framework for implementing the guidance contained within the NIST Secure Software Development Framework (SSDF), for traditional software systems, AI-enabled applications, and software that incorporates generative AI components.

 Through realistic case studies and hands-on exercises, you will learn to evaluate existing software development practices, identify security gaps, improve DevOps pipelines, integrate NIST SSDF guidance, and apply Secure DevOps principles to both traditional software and AI-enabled systems.

 This certification training course will help you prepare for and successfully attain the highly respected SecDevOps Foundation (SDOF) certification. In this course, you will discover: 

  • The benefits, concepts, processes and vocabulary of SecDevOps to deliver secure software while maintaining Agile speed, flexibility, and quality.
  • How SecDevOps extends Agile and DevOps for CI/CD/CC - Continuous Integration, Continuous Delivery, Continuous Compliance.
  • How the guidance of the NIST Secure Software Development Framework integrates naturally to complement SecDevOps practices.
  • Which organizational culture and individual mindset changes are best to maximize success securing traditional and AI applications.
  • How to plan, design and use a pipeline to test and automate the testing, deployment, security validation, and monitoring of production environments.
  • How modern threat modeling, secure design, vulnerability management, and automated security testing work together throughout the software lifecycle.

SecDevOps Training Delivery Methods

  • In-Person

  • Online

  • Upskill your whole team by bringing Private Team Training to your facility.

SecDevOps Foundation Training Information

  • In this SecDevOps Foundation Course, you will learn how to:

    • Prepare for official SecDevOps Foundational certification (SDOF) from the DevOps Institute by PeopleCert.
    • Throughout the course, students complete numerous hands-on activities using modern DevOps tools, secure development pipelines, threat modeling techniques, vulnerability analysis, and collaborative team exercises
    • Leverage the NIST Secure Software Development Framework to guide the security practices of SecDevOps for both traditional and AI applications.
    • Establish continuous improvement practices to face new or unanticipated challenges

  • Prerequisites

    None.

  • SecDevOps Foundation Certification Details

    • The 60-minute certification exam is open-book and taken online after the course delivery has finished. An exam voucher is included in the course tuition.
    • The certification exam is administered through the DevOps Institute by PeopleCert.

SecDevOps Foundation Training Outline

Module 1: SecDevOps Context

  • Megatrends and Context
  • CALM Principles
  • The 3 Ways 

Module 2: Foundations of Secure DevOps

  • Iterative and incremental
  • From Scrum to SecDevOps
  • Automated testing for TDD and ATDD
  • Activity: Create secure password scenarios using BDD
  • Key principles and security-first philosophy 
  • SecDevOps guidance from the NIST SSDF
  • Exercise: SecDevOps and NIST SSDF synergy

Module 3: Secure DevOps Pipeline and Toolchain

  • Continuous Integration, Delivery, Deployment and Compliance
  • SecDevOps lifecycle and the Pipeline
  • Pipeline for development
  • Pipeline for operations (Configuration as Code)
  • Activity: Using a Vulnerability Scanner, Hands-On
  • Cloud, containers and security integration
  • Pipeline maturity and planning
  • Pipeline and other development tools
  • Activity: Planning Pipeline Security Testing
  • Using Source Repositories Git, GitLab, GitHub
  • Branching strategies, merge conflicts, and secure pull requests
  • Activity: Running a Secure CI/CD/CC Pipeline, Hands-On

Module 4: Risk, Vulnerabilities and Threats

  • Risk assessment – key goal
  • Cyber intelligence (know the enemy)
  • Threat and Vulnerability Catalogs
  • Activity: SQL Injection Example, Hands-On
  • Threat modeling (STRIDE, OCTAVE and the PASTA process)
  • Activity: Threat Modeling, Gamification
  • Gathering threat and vulnerability metrics
  • Activity: Quantitative Scoring of Vulnerabilities (CVSS), Hands-On

Module 5: Culture Change and Leadership Mindset

  • What is good culture?
  • Culture assessment models – safe, trustworthy and empowering
  • Activity: Identifying and improving your organization’s culture, video review
  • Leadership Mindset – Fixed or Growth
  • Scaling Secure DevOps (SAFe, Platform Engineering, and SRE)
  • Personnel, stakeholders and the team
  • Homework: Mindset self-evaluation spreadsheet (optional)

Module 6: Best Practices for SecDevOps

  • Planning with a vision – start from where you are
  • Measuring your organization’s SecDevOps maturity
  • Exercise: SecDevOps Implementation Stages, survey
  • AI-assisted development and secure use of generative AI
  • Security considerations for AI-generated software
  1. Embracing and enabling organization-level governance
  • Why care about GRC? 
  • Rethinking policies - policy as code
  • Building a responsive model
  • Deploying immutable infrastructure
  • Ongoing monitoring and evaluation
  • Activity: Intrusion Detection, hands-on

Module 7: Continuous Learning

  • Experiential learning
  • Retrospective learning
  • Continual improvement
  • Learning sources

Module 8: Review and Summary

  • Exam review
  • Key course concepts
  • Next steps

 

Commercial Pricing

£1,650

  • 3-day instructor-led training course

  • After-course instructor coaching available

  • DevOps Institute certification exam included

Would you like to take this course as a team?
  • Guaranteed-to-Run - You can rest assured this class will not be canceled. Delivery format is subject to change – please call Customer Service if you have any questions.
    Sep 23 - 25 2:00 PM - 9:30 PM BST
    Virtual
  • Nov 4 - 6 2:00 PM - 9:30 PM GMT
    Herndon, VA or Virtual
  • Dec 9 - 11 2:00 PM - 9:30 PM GMT
    New York or Virtual
  • Guaranteed-to-Run - You can rest assured this class will not be canceled. Delivery format is subject to change – please call Customer Service if you have any questions.
    Dec 16 - 18 9:00 AM - 4:30 PM GMT
    London or Virtual
  • Mar 10 - 12 2:00 PM - 9:30 PM GMT
    Ottawa or Virtual
  • Mar 23 - 25 9:00 AM - 4:30 PM GMT
    London or Virtual
  • Apr 14 - 16 2:00 PM - 9:30 PM BST
    Herndon, VA or Virtual
  • Jun 22 - 24 9:00 AM - 4:30 PM BST
    London or Virtual
  • Jun 28 - 30 2:00 PM - 9:30 PM BST
    Herndon, VA or Virtual
  • Aug 18 - 20 2:00 PM - 9:30 PM BST
    Ottawa or Virtual

Scroll to view additional course dates

Speak with a Learning Consultant
* Required Fields

Need Help Finding The Right Training Solution?

Our training advisors are here for you.

Contact Us

SecDevOps Foundation Training FAQs

SecDevOps is a powerful modern approach for creating software that integrates security into the development life cycle. The U.S (United States). Department of Homeland Security (DHS) initiative effectiveness has been empirically proven to improve cyber protection significantly.

As a result, it is invaluable for reaching current CMMC (Cybersecurity Maturity Model Certification) requirements for vendors and government agencies.

DevSecOps and SecDevOps are remarkably similar frameworks. SecDevOps is formally proffered by DHS and has a distinctly “security first” philosophy. Over time, SecDevOps is evolving new insights and practices that go beyond the original scope of DevSecOps (such as planning, acquisition, and disposal of assets).

This course is intended for security experts, software developers, and operations specialists who must work in collaborative teams and understand SecDevOps basics. Accordingly, the material proceeds quickly into applicable practices for achieving highly robust CI/CD/CC results. The goal is to know where you are now, where you want to be in the future, and how best to get there.

PeopleCert CPDs are the continuing education credits that help you maintain PeopleCert certifications in PRINCE2, ITIL and DevOps Institute. 

Maintaining PeopleCert Certifications
All PeopleCert Business and IT certifications (including PRINCE2, ITIL and DOI) must be renewed within three years of their original certification date. There are two ways to keep certifications current: 

  1. Join PeopleCert Plus (a paid membership) to earn 20 CPDs per year for 3 years and renew certifications that way. 
  2. Earn another certification from the same Product Suite (for example, to renew all ITIL certifications you can earn a new ITIL certification) 

Eligible Learning Tree Training
Learning Tree training is not eligible for the PeopleCert Plus CPD program. Attendees can renew their PeopleCert certifications with Learning Tree by enrolling in another certification from the product suite they're trying to renew. Examples: 

  1. If you hold an ITIL 4 Foundation certification, and you acquire an ITIL 4 Practitioner or ITIL 4 Specialist certification, all your certification(s) belonging to the ITIL 4 Product Suite will be renewed.
  2. Similarly, if you hold a PRINCE2 Practitioner certification and you acquire an MSP Foundation, all your certification(s) belonging to the PRINCE2 Project, Programme & Portfolio Management Suite will be renewed.

Learn more about eligibility and CPDs on the PeopleCert website: Keep your certifications current| (peoplecert.org)

Attendee Process for Renewing PeopleCert Certifications with Learning Tree
Once an attendee successfully earns a PeopleCert certification from the same product suite they're trying to renew, their other certifications in that product suite will automatically renew. 

Approval Policies
N/A

Related Courses

  • DevOps Institute
    DevOps Foundation® (DOFD) Certification Training

    The DevOps Foundation® (DOFD) Certification training includes a collection of basic DevOps terms and concepts, highlights all aspects of DevOps, and more.

    Foundation
    2 days
    Online or In-class
    Starts from £1,325
  • DevOps Institute
    Site Reliability Engineering Foundation® (SREF) Certification Training

    The Site Reliability Engineering® (SRE) Foundation Training course highlights the evolution of SRE and its future, plus prepares you to complete the SRE exam.

    Foundation
    2 days
    Online or In-class
    Starts from £1,295
  • DevOps Institute
    DevOps Leader® (DOL) Certification Training

    DevOps Leader® (DOL) Certification Training provides the insights, techniques & innovative approaches for leaders involved in a DevOps cultural transformation.

    Intermediate
    2 days
    Team Training