iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
OWASP SAMM is a framework for assessing and improving an organization’s software security practices. Use it to understand current practices, choose risk-based improvement targets, and build a roadmap—not as a certification, a universal checklist, or proof that software is secure.
What OWASP SAMM is—and what it is not
SAMM stands for Software Assurance Maturity Model. OWASP describes it as an open, technology- and process-agnostic framework for formulating and implementing a software security strategy suited to an organization’s risks. It spans the software lifecycle and is intended to help teams assess their posture and improve it over time. OWASP’s project page lists SAMM version 2.2.0.
SAMM is a model for organizing and improving practices, not a product or a prescribed implementation recipe. It does not set one maturity target for every organization, certify compliance, or guarantee that an application is secure. A team should use its activities and maturity descriptions in light of its own risks, business needs, delivery model, and capacity.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How the SAMM model is organized
SAMM groups its software assurance work into five business functions, each with three security practices. In total, the model has five functions and fifteen practices. The model overview describes this structure.
#1 Best Overall
| Business function | Security practices |
|---|---|
| Governance | Strategy and Metrics; Policy and Compliance; Education and Guidance |
| Design | Threat Assessment; Security Requirements; Secure Architecture |
| Implementation | Secure Build; Secure Deployment; Defect Management |
| Verification | Architecture Assessment; Requirements-driven Testing; Security Testing |
| Operations | Incident Management; Environment Management; Operational Management |
Each practice contains activities arranged into streams and is described across three maturity levels. The activities give teams concrete areas to examine and improve; the levels describe increasing structure and sophistication in how the practice is carried out. The model is designed to support assessment, target-setting, roadmap definition, and prescriptive guidance for implementing activities. OWASP’s SAMM overview explains these components.
What the three maturity levels mean
OWASP’s version 2 release notes describe the levels as initial implementation, structured realization, and optimized operation. They represent a progression in organizational practice rather than a universal score threshold.
Rank #2
- Initial implementation: Activities are generally easier to execute and require less formalization.
- Structured realization: Practice becomes more organized and repeatable, with greater definition of how activities are performed.
- Optimized operation: Objectives become more sophisticated, with stricter success measures and a stronger emphasis on refinement.
Version 2 also introduced maturity measurement from both coverage and quality perspectives. Coverage asks whether relevant activities are in place; quality considers how well and consistently they are performed. A team should not treat a single maturity score as a complete account of software risk or as a basis for ranking organizations without context. The version 2 release notes describe the maturity model and measurement approach.
How to use SAMM to build an improvement roadmap
- Assess current practices. Use the SAMM assessment approach and its toolbox to review activity questions and understand current maturity. Record evidence and distinguish an activity that is absent from one that exists but is inconsistent or ineffective. The SAMM Assessment page provides the assessment resources.
- Identify gaps that matter. Review findings across the five business functions, then consider which gaps expose the organization to its most important software risks. Do not assume every practice deserves the same urgency or investment.
- Choose a realistic target. Set a target for relevant activities based on risk, business needs, delivery context, and available capacity. A target is useful when it is achievable and tied to a genuine need—not simply because it is a higher maturity level.
- Turn the target into a roadmap. Order improvements, assign ownership, and define how progress will be measured. Prefer clear objectives and evidence of completion over an unexplained organization-wide score.
- Reassess as practices change. Repeat the assessment as the program evolves so teams can check whether activities have become more reliable and whether priorities have shifted.
How to tailor SAMM to your organization
SAMM supports waterfall, iterative, agile, and DevOps approaches, and is not tied to a particular technology stack or process. That flexibility does not make every activity equally relevant everywhere. Apply the model selectively, based on the risks and operating context of the software being built and maintained. OWASP’s version 2 release notes describe its support for different development approaches.
When deciding what to prioritize, test each proposed target against practical questions:
Quick Recap
Best Value
Rank #4
- Risk coverage: Does the practice address a material risk to the organization’s software?
- Lifecycle coverage: Have governance, design, implementation, verification, and operations all been considered?
- Evidence and quality: Is the activity performed consistently and effectively, or does it exist only on paper?
- Practicality: Is there a clear owner, enough skill and capacity, and a workable fit with the team’s delivery process?
- Progress measurement: Are the target activity’s objectives and success measures clear enough to evaluate?
Common ways teams misapply SAMM
- Chasing the highest level everywhere: SAMM does not prescribe one target for all practices. Prioritize based on risk and organizational needs.
- Treating a score as a security verdict: Maturity indicates how practices are organized and performed; it does not prove that a product is secure or establish regulatory compliance.
- Counting coverage without examining quality: A documented activity may not be effective or consistently applied. Consider both dimensions when assessing progress.
- Applying activities without context: SAMM is adaptable, so use judgment about relevance, ownership, and fit instead of treating its activities as an identical checklist for every team.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
