Securitytrue

SecurityTrue is a security framework and certification program intended to evaluate the security posture of software products, services, and organizations. It provides a common set of requirements for governance, risk management, data protection, identity and access management, application security, incident response, and supply chain security, with the aim of helping buyers compare security practices across vendors and promote baseline risk management.

SecurityTrue was developed by the Global Information Security Alliance and first published in 2018. The framework has evolved through periodic updates to address evolving threats, regulatory expectations, and advances in cloud-native architectures. The current version emphasizes automated assurance and continuous monitoring alongside periodic independent audits.

Core components include a governance framework with defined roles and policies, a control catalog aligned to recognized standards (such as ISO/IEC 27001, NIST SP 800-53, and CSA CCM), and a certification process that combines evidence-based assessment with independent verification. Certifications can cover product security, organizational practices, or supply chain security, and require periodic renewals to remain active.

Adoption has grown among enterprise software vendors, cloud providers, and financial institutions. Proponents say SecurityTrue provides clearer risk signals for buyers, improves due diligence in procurement, and supports regulatory compliance. Critics note the potential cost and effort of certification, possible overlaps with existing standards, and the need for continuous compliance to sustain certification.

SecurityTrue maintains alignment guidance for auditors, updates to address new threats such as software supply chain risks, and considerations for zero-trust architectures. It is one of several security assurance frameworks used to benchmark and communicate security controls in software products and services.