SAMM

Software Assurance Maturity Model (SAMM) is a framework published by the Open Web Application Security Project (OWASP) to help organizations plan, implement, and measure software security programs. It provides a practical, vendor-neutral approach for improving software security across the development lifecycle, from governance to deployment. The model is designed to be technology- and language-agnostic, scalable to organizations of different sizes and maturities, and capable of aligning security activities with business objectives.

SAMM organizes security work into four core business functions: Governance, Construction, Verification, and Deployment. Each function contains a set of security practices and activities arranged to guide improvement across disciplines such as policy and governance, secure design and architecture, secure coding, security testing, release management, and operational security. Practices are described with concrete goals, activities, and measurable outcomes to help teams assess current capability and plan a roadmap.

The SAMM framework uses a maturity perspective, allowing organizations to assess their current practices and target a higher level of capability over time. It supports measurement, benchmarking, and progress tracking, and it can be used to map software security efforts to compliance, risk management, and process improvement initiatives. OWASP provides guidance, reference material, and community resources to support adoption, including mappings to other standards and frameworks and guidance for integrating SAMM with development methodologies such as agile and DevOps.