SecDevOps Foundation® (SDOF) Certification Training

Duration: 3 days
Labs: Yes
Exam Voucher: Yes
Language: English
Level: Intermediate

Secure DevOps (SecDevOps) represents the evolution of DevOps toward a security-first software engineering approach. Building upon guidance from the U.S. Department of Homeland Security (DHS), the NIST Secure Software Development Framework (SSDF), and modern DevOps practices, SecDevOps integrates security throughout the entire software lifecycle—including today's AI-enabled applications.

Consequently, SecDevOps has become the “go to” methodology for organizations writing high-assurance programs, especially for government agencies, defense contractors, financial institutions, healthcare organizations, critical infrastructure providers, and any organization developing security-sensitive software. It provides an excellent operational framework for implementing the guidance contained within the NIST Secure Software Development Framework (SSDF), for traditional software systems, AI-enabled applications, and software that incorporates generative AI components.

Through realistic case studies and hands-on exercises, you will learn to evaluate existing software development practices, identify security gaps, improve DevOps pipelines, integrate NIST SSDF guidance, and apply Secure DevOps principles to both traditional software and AI-enabled systems.

This certification training course will help you prepare for and successfully attain the highly respected SecDevOps Foundation (SDOF) certification. In this course, you will discover:

The benefits, concepts, processes and vocabulary of SecDevOps to deliver secure software while maintaining Agile speed, flexibility, and quality.
How SecDevOps extends Agile and DevOps for CI/CD/CC - Continuous Integration, Continuous Delivery, Continuous Compliance.
How the guidance of the NIST Secure Software Development Framework integrates naturally to complement SecDevOps practices.
Which organizational culture and individual mindset changes are best to maximize success securing traditional and AI applications.
How to plan, design and use a pipeline to test and automate the testing, deployment, security validation, and monitoring of production environments.
How modern threat modeling, secure design, vulnerability management, and automated security testing work together throughout the software lifecycle.

SecDevOps Training Delivery Methods

In-Person
Online
Upskill your whole team by bringing Private Team Training to your facility.

SecDevOps Foundation Training Information

In this SecDevOps Foundation Course, you will learn how to:
- Prepare for official SecDevOps Foundational certification (SDOF) from the DevOps Institute by PeopleCert.
- Throughout the course, students complete numerous hands-on activities using modern DevOps tools, secure development pipelines, threat modeling techniques, vulnerability analysis, and collaborative team exercises
- Leverage the NIST Secure Software Development Framework to guide the security practices of SecDevOps for both traditional and AI applications.
- Establish continuous improvement practices to face new or unanticipated challenges
Prerequisites

None.
SecDevOps Foundation Certification Details
- The 60-minute certification exam is open-book and taken online after the course delivery has finished. An exam voucher is included in the course tuition.
- The certification exam is administered through the DevOps Institute by PeopleCert.

SecDevOps Foundation Training Outline

Learning Objectives

Module 1: SecDevOps Context

Megatrends and Context
CALM Principles
The 3 Ways

Module 2: Foundations of Secure DevOps

Iterative and incremental
From Scrum to SecDevOps
Automated testing for TDD and ATDD
Activity: Create secure password scenarios using BDD
Key principles and security-first philosophy
SecDevOps guidance from the NIST SSDF
Exercise: SecDevOps and NIST SSDF synergy

Module 3: Secure DevOps Pipeline and Toolchain

Continuous Integration, Delivery, Deployment and Compliance
SecDevOps lifecycle and the Pipeline
Pipeline for development
Pipeline for operations (Configuration as Code)
Activity: Using a Vulnerability Scanner, Hands-On
Cloud, containers and security integration
Pipeline maturity and planning
Pipeline and other development tools
Activity: Planning Pipeline Security Testing
Using Source Repositories Git, GitLab, GitHub
Branching strategies, merge conflicts, and secure pull requests
Activity: Running a Secure CI/CD/CC Pipeline, Hands-On

Module 4: Risk, Vulnerabilities and Threats

Risk assessment – key goal
Cyber intelligence (know the enemy)
Threat and Vulnerability Catalogs
Activity: SQL Injection Example, Hands-On
Threat modeling (STRIDE, OCTAVE and the PASTA process)
Activity: Threat Modeling, Gamification
Gathering threat and vulnerability metrics
Activity: Quantitative Scoring of Vulnerabilities (CVSS), Hands-On

Module 5: Culture Change and Leadership Mindset

What is good culture?
Culture assessment models – safe, trustworthy and empowering
Activity: Identifying and improving your organization’s culture, video review
Leadership Mindset – Fixed or Growth
Scaling Secure DevOps (SAFe, Platform Engineering, and SRE)
Personnel, stakeholders and the team
Homework: Mindset self-evaluation spreadsheet (optional)

Module 6: Best Practices for SecDevOps

Planning with a vision – start from where you are
Measuring your organization’s SecDevOps maturity
Exercise: SecDevOps Implementation Stages, survey
AI-assisted development and secure use of generative AI
Security considerations for AI-generated software

Embracing and enabling organization-level governance

Why care about GRC?
Rethinking policies - policy as code
Building a responsive model
Deploying immutable infrastructure
Ongoing monitoring and evaluation
Activity: Intrusion Detection, hands-on

Module 7: Continuous Learning

Experiential learning
Retrospective learning
Continual improvement
Learning sources

Module 8: Review and Summary

Exam review
Key course concepts
Next steps

Commercial Pricing

£1,650

3-day instructor-led training course
After-course instructor coaching available
DevOps Institute certification exam included

Would you like to take this course as a team?

Include dates with afternoon start times

Nov 4 - 6 2:00 pm - 9:30 pm GMT

Herndon, VA or Virtual
Dec 9 - 11 2:00 pm - 9:30 pm GMT

New York or Virtual
Dec 16 - 18 9:00 am - 4:30 pm GMT

London or Virtual
Mar 10 - 12 2:00 pm - 9:30 pm GMT

Ottawa or Virtual
Mar 23 - 25 9:00 am - 4:30 pm GMT

London or Virtual
Apr 14 - 16 2:00 pm - 9:30 pm BST

Herndon, VA or Virtual
Jun 22 - 24 9:00 am - 4:30 pm BST

London or Virtual
Jun 28 - 30 2:00 pm - 9:30 pm BST

Herndon, VA or Virtual
Aug 18 - 20 2:00 pm - 9:30 pm BST

Ottawa or Virtual

Scroll to view additional course dates

Speak with a Learning Consultant

Inquiring For

Myself

Team/Group

First Name*

Last Name*

Email*

Phone Number*

Company*

Job Title

I'm interested In

* Required Fields

Need Help Finding The Right Training Solution?

Our training advisors are here for you.

SecDevOps Foundation Training FAQs

SecDevOps is a powerful modern approach for creating software that integrates security into the development life cycle. The U.S (United States). Department of Homeland Security (DHS) initiative effectiveness has been empirically proven to improve cyber protection significantly.

As a result, it is invaluable for reaching current CMMC (Cybersecurity Maturity Model Certification) requirements for vendors and government agencies.

DevSecOps and SecDevOps are remarkably similar frameworks. SecDevOps is formally proffered by DHS and has a distinctly “security first” philosophy. Over time, SecDevOps is evolving new insights and practices that go beyond the original scope of DevSecOps (such as planning, acquisition, and disposal of assets).

This course is intended for security experts, software developers, and operations specialists who must work in collaborative teams and understand SecDevOps basics. Accordingly, the material proceeds quickly into applicable practices for achieving highly robust CI/CD/CC results. The goal is to know where you are now, where you want to be in the future, and how best to get there.

PeopleCert CPDs are the continuing education credits that help you maintain PeopleCert certifications in PRINCE2, ITIL and DevOps Institute.

Maintaining PeopleCert Certifications
All PeopleCert Business and IT certifications (including PRINCE2, ITIL and DOI) must be renewed within three years of their original certification date. There are two ways to keep certifications current:

Join PeopleCert Plus (a paid membership) to earn 20 CPDs per year for 3 years and renew certifications that way.
Earn another certification from the same Product Suite (for example, to renew all ITIL certifications you can earn a new ITIL certification)

Eligible Learning Tree Training
Learning Tree training is not eligible for the PeopleCert Plus CPD program. Attendees can renew their PeopleCert certifications with Learning Tree by enrolling in another certification from the product suite they're trying to renew. Examples:

If you hold an ITIL 4 Foundation certification, and you acquire an ITIL 4 Practitioner or ITIL 4 Specialist certification, all your certification(s) belonging to the ITIL 4 Product Suite will be renewed.
Similarly, if you hold a PRINCE2 Practitioner certification and you acquire an MSP Foundation, all your certification(s) belonging to the PRINCE2 Project, Programme & Portfolio Management Suite will be renewed.

Learn more about eligibility and CPDs on the PeopleCert website: Keep your certifications current| (peoplecert.org)

Attendee Process for Renewing PeopleCert Certifications with Learning Tree
Once an attendee successfully earns a PeopleCert certification from the same product suite they're trying to renew, their other certifications in that product suite will automatically renew.

Approval Policies
N/A

SecDevOps Foundation® (SDOF) Certification Training

SecDevOps Training Delivery Methods

SecDevOps Foundation Training Information

SecDevOps Foundation Training Outline

Learning Objectives

Live Instructor £1,650

SecDevOps Foundation Training FAQs

What is SecDevOps?

What is the difference between DevSecOps and SecDevOps?

Who should attend this course?

How do I maintain my DevOps Institute certification?

Related Courses