OWASP SAMM is an open framework for assessing and improving software security practices across the software lifecycle. Use it to understand what your organization does today, choose improvements that fit its risks and capacity, and turn those priorities into a roadmap—not to chase a universal score or claim that software is secure.
What OWASP SAMM is—and what it is not
SAMM stands for Software Assurance Maturity Model. OWASP describes it as a technology- and process-agnostic framework for formulating and implementing a software security strategy tailored to an organization’s risks. It can be applied across the software lifecycle and adapted to different development contexts. OWASP’s project page lists version 2.2.0; check the page for the current release before beginning an assessment.
As an Amazon Associate I earn from qualifying purchases.
SAMM is a model for improving practices, not a software product, certification, or universal checklist. Its maturity levels describe how practices are organized and developed. They do not, by themselves, prove regulatory compliance or guarantee that an application is secure.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow the SAMM model is organized
The model groups fifteen security practices into five business functions. Each function contains three practices. Within a practice, activities are arranged into streams and distributed across three maturity levels. This structure lets a team examine its current posture, set a target, and define improvement work. OWASP’s model page describes the functions and practices; its overview explains the model’s activities and roadmap use.
#1 Best Overall
| Business function | Security practices |
|---|---|
| Governance | Strategy and metrics; Policy and compliance; Education and guidance |
| Design | Threat assessment; Security requirements; Secure architecture |
| Implementation | Secure build; Secure deployment; Defect management |
| Verification | Architecture assessment; Requirements-driven testing; Security testing |
| Operations | Incident management; Environment management; Operational management |
The five functions make lifecycle coverage visible: security work is not confined to code review or testing. Governance establishes direction and enables teams; design addresses risks and requirements; implementation shapes how software is built and released; verification checks whether security expectations are met; and operations covers the environment and response after deployment.
What the three maturity levels mean
OWASP’s version 2 release notes name the levels initial implementation, structured realization, and optimized operation. They represent an increasing degree of structure and sophistication in a practice, rather than a pass/fail scale or an organization-wide security grade. Lower-level activities are generally easier to execute and less formalized; higher levels have more sophisticated objectives and stricter success measures. The version 2 release notes also explain that SAMM measures maturity through both activity coverage and quality.
Rank #2
That distinction matters when interpreting an assessment. A team may perform an activity in some projects but do so inconsistently, or may have a repeatable process that still lacks adequate coverage. Consider both whether relevant activities happen and how reliably and effectively they are performed. A single maturity number can conceal those differences.
How to use SAMM to improve your program
-
Assess current practices
Use the SAMM assessment approach and toolbox to review the activity questions and determine what is currently in place. Gather evidence from the people who own or perform the work—such as development, security, and operations—rather than treating an unanswered question as proof that a practice does not exist. The SAMM assessment page provides the assessment resources.
-
Choose a risk-based target
Identify the gaps that matter most in light of your software risks, business needs, delivery context, skills, and available capacity. A target should be realistic and relevant: a practice that reduces a material risk deserves priority over a higher maturity level pursued only for appearance. SAMM is explicitly designed to be tailored; it does not prescribe one implementation recipe or target for every organization.
-
Build an ordered roadmap
Translate the target into a sequence of improvements with owners, objectives, and measures suited to the activities selected. Make dependencies and capacity visible so the roadmap can be delivered alongside product work. Use the activity objectives and success measures at the chosen level to tell whether a change is working, not merely whether a document or process has been created.
-
Reassess as practices change
Revisit the assessment as teams, systems, and risks evolve. Compare evidence over time to see whether activity coverage and quality have improved, and adjust priorities when business or technical conditions change. The goal is a useful feedback loop, not a score that remains meaningful regardless of context.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
How to choose priorities and interpret progress
When deciding between possible improvements or target states, compare them on the dimensions that make the work useful to your organization:
Best Value
- Risk coverage: Does the practice address a significant software risk you actually face?
- Lifecycle coverage: Are governance, design, implementation, verification, and operations considered, or is the plan concentrated in only one phase?
- Evidence and quality: Is the activity performed consistently and to an adequate standard, as well as being present on paper?
- Practicality: Is there a clear owner, with the skills and capacity to implement the change within your delivery process?
- Progress measurement: Does the target activity have a clear objective and a meaningful way to evaluate success?
SAMM supports waterfall, iterative, agile, and DevOps approaches, according to OWASP’s version 2 release notes. That flexibility does not mean every activity fits every team equally. Select and adapt activities according to risk and context, then use evidence to judge whether the chosen practice is effective.
Quick Recap
Common mistakes to avoid
- Chasing maturity for its own sake: A higher level is not automatically the right investment if it does not address a priority risk or business need.
- Treating the model as a compliance certificate: An assessment can inform security improvement, but maturity does not establish compliance or guarantee secure software.
- Equating documented process with effective practice: Evaluate actual coverage and quality, not only the existence of policies, plans, or tools.
- Applying every activity uniformly: Tailor the roadmap to the organization’s products, threats, delivery model, and resources.
- Comparing organizations by one score: A score without context can hide differences in risk, scope, evidence, and practice quality. Use SAMM primarily to guide and measure your own improvement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
