What are the key components and events in the Scrum framework?
An agile framework that delivers work in fixed-length sprints, each producing a working increment — built from three artifacts, several events, and three roles.
Scrum is an agile framework with:
Artifacts:
- Product Backlog — prioritized list of all desired features
- Sprint Backlog — items selected for the current sprint
- Increment — working software delivered each sprint
Events:
- Sprint Planning — team selects backlog items
- Daily Scrum — 15-min daily standup
- Sprint Review — demo to stakeholders
- Sprint Retrospective — team process improvement
Roles: Product Owner, Scrum Master, Development Team
Where security fits in Scrum: Security work isn't a separate phase — it's woven into the existing ceremonies. Security needs become backlog items (often written as abuser stories: "as an attacker, I want to…"), so the Product Owner can prioritize them like any other work. A common pattern is the Definition of Done requiring that code pass security checks (SAST, dependency scan) before an increment counts as "done." The retrospective is where the team improves its security process over time. If security never makes it into the backlog or the Definition of Done, Scrum's fast cadence will happily ship insecure increments.
Go deeper:
Scrum (software development) — Wikipedia — the three artifacts, events, roles, and the time-boxed sprint.