Home / Knowledge hub / OWASP SAMM
Knowledge hub
OWASP SAMM
A model for measuring and improving how well an organisation builds secure software.
What it means
The Software Assurance Maturity Model, or SAMM, is an OWASP project. It is a free framework for assessing how well an organisation builds and runs secure software, and for planning improvements in steps. It works as a planning tool rather than an audit.
It covers five business functions: Governance, Design, Implementation, Verification and Operations. Each has three security practices, giving fifteen in all, and each practice is scored at maturity levels one to three. The result is a picture of strengths and gaps, not a pass or fail.
Why it matters
Many companies add security tools piecemeal, in response to the last incident or the last customer request. SAMM gives you a way to see the whole picture and choose what to do next, rather than guessing which tool, DevSecOps change or hire matters most.
It suits a business that wants to improve steadily and show it. You can assess today, set a target for the next year, and measure again. That is useful when a buyer, investor or board member asks how mature your security practice is, and you want an answer beyond a list of tools.
How it shows up
A team usually starts with a short assessment, a workshop or a questionnaire covering each practice. The scores show which areas lag, and a roadmap picks a few improvements, such as adding threat modelling or regular testing. Repeat every year or so to see movement.
The mistakes repeat. The assessment is done once and filed away. Teams aim for the top level everywhere, which is rarely worth the cost. Or scoring is generous because nobody checks the evidence. Choose targets that match your risk, and tie improvements to owners and dates. A small company can start with a few practices, such as secure code review.
Questions people ask
OWASP SAMM, answered
Is SAMM the same as ASVS?
No. ASVS lists security requirements for an application. SAMM measures how mature your organisation is at building secure software. One covers the product, the other the process around it. Many teams use both.
Do we need to reach level 3 in every practice?
No. Level 3 is costly and not always justified. Set targets by risk, and aim higher only where a failure would hurt most. A spread of levels is normal. Match effort to risk.
Is SAMM only for large companies?
No. Small teams can use it too, by assessing a few practices and keeping the roadmap short. It scales to the size of the business. The model is flexible about size.
How is SAMM different from BSIMM?
BSIMM describes what other companies actually do, from observation. SAMM is a prescriptive model that you use to set goals. Both help; they answer different questions. It is worth knowing both exist.
How often should we reassess?
Yearly is common, or after a major change in team or product. More often than that gives noise, and less often lets the roadmap drift. Pick a rhythm and keep to it.
Sources
Where this comes from
Related
Terms that sit next to this one
OWASP ASVS
A detailed checklist of security requirements for web applications.
Secure SDLC
Building security checks into every stage of how software is planned, built and shipped.
DevSecOps
Making security a shared, automated part of development and operations.
Security champion
A developer in a team who takes on security questions and spreads good habits.
Secure code review
Reading code specifically to spot security flaws before they ship.
What would your first fix be?
A maturity score shows where the gaps are, and testing shows what they cost. We can show proven findings, with severity and confidence kept apart, to help you choose. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.