Secure Development Program Assessment (OWASP SAMM)

Overview

The OWASP Software Assurance Maturity Model (SAMM) is an open model for measuring and improving how an organization builds secure software. A secure development program assessment uses SAMM to show where your program stands today, where it should go next, and in what order.

SAMM v2 organizes a software assurance program into five business functions, Governance, Design, Implementation, Verification, and Operations, each with three security practices, and scores each practice by maturity level. That gives you a security baseline, a prioritized set of improvements, a way to measure progress, and a clear way to communicate your maturity to customers and auditors.

What This Assessment Covers

This assessment measures your organization’s software assurance program: how your teams plan, build, verify, deploy, and operate software, and the policies and training behind that work. It looks at the process around the code across your teams and applications. It does not test the code of a particular application.

Need something adjacent?

• To assess a specific application’s code against a published standard, see our application vulnerability assessment.
• To audit how a specific application signs users in and controls access, see our fixed-price authentication and access control audit.
• To add dependency and container scanning to your build, one of the practices SAMM measures, see our secure CI/CD pipelines.

How We Work

Our expertise is the hard technical side of SAMM maturity, such as the Secure Build, Secure Deployment, Defect Management, and Security Testing practices. A typical assessment involves an initial consultation to understand your current maturity level and goals, interviews with the people who build and run your software, a review of your development practices and relevant technical controls, and a findings report mapped to SAMM maturity levels with actionable recommendations and a prioritized roadmap.

We are proud to partner with New Oceans Enterprises, led by Donna Gallaher, to provide a comprehensive solution for your SAMM journey. While our expertise lies in the technical assessment and implementation aspects, New Oceans Enterprises specializes in developing the necessary security policies and addressing other organizational needs crucial for achieving higher SAMM maturity ratings. Their vCISO services further support organizations requiring strategic security leadership.

Frank Rietta, a life member of OWASP, can provide signed attestation letters or bridge letters to help demonstrate your organization’s current SAMM maturity level to your stakeholders.

Not Authorized by OWASP

Please note that OWASP does not accredit or authorize specific companies to conduct assessments against SAMM. Our use of their mark on this page is for fair use only to clearly identify the standard that we follow. You are free to read and follow this standard on your own or use any consultant or contractor of your choice.

Frank Rietta is a life member of OWASP, believes strongly in their mission, and supports the local club organization.