Security is definitely one of the most important aspects in business information systems. This aspect is strongly related to costs, risks and reputation of organization. That’s why authors want to propose “secure-by-design” principle by using innovative and proven development approaches in whole system lifecycle to maintain high security level. There are already some existing techniques to solve this problem but they are mainly linked with specific technologies and most frequently focus only on production phase. This paper presents new secure system development methodology based on three general aspects – model-driven secure code development, model-driven policy development and usage of run-time security management system to maintain necessary security level. All these aspects are integrated into one framework.