Overview
OWASP SAMM (Software Assurance Maturity Model) is an open framework that helps organizations formulate and implement a strategy for software security tailored to the specific risks the organization faces. It provides a measurable, risk-driven way to analyze and improve an organization's entire secure software development lifecycle (SDLC), and is deliberately technology- and process-agnostic so it fits any development methodology, language, or toolchain.
SAMM is an OWASP Flagship project, led by Seba Deleersnyder and Bart De Win. Rather than mandating a single 'right' way to build software, it lets organizations evaluate their existing practices, define a balanced security assurance program in well-defined iterations, and demonstrate concrete, measurable improvements over time.
SAMM provides an effective and measurable way for all types of organizations to analyze and improve their software security posture.
Model structure
The SAMM v2 model is organized around five core Business Functions, each representing a critical area of activity in building and operating software. Each Business Function is broken down into three Security Practices, giving 15 practices in total.
- Governance: Strategy & Metrics, Policy & Compliance, Education & Guidance
- Design: Threat Assessment, Security Requirements, Security Architecture
- Implementation: Secure Build, Secure Deployment, Defect Management
- Verification: Architecture Assessment, Requirements-driven Testing, Security Testing
- Operations: Incident Management, Environment Management, Operational Management
Each of the 15 Security Practices is further divided into two Streams, two related but distinct sets of activities that mature in parallel. Within each stream, activities are mapped to three Maturity Levels (1 to 3), expressing a progression from an initial, ad-hoc adoption (Level 1) through to comprehensive mastery and continuous improvement (Level 3).
Assessment
Organizations measure their current posture using the SAMM Assessment Toolbox, a spreadsheet available in both Microsoft Excel and Google Sheets formats. An Interview tab poses questions for each activity in the model, and as answers are recorded the Scorecard tab automatically calculates a maturity score for every Security Practice. The assessment can be run as a lightweight self-assessment or a more detailed evaluation via stakeholder interviews and workshops.
- Score each of the 15 practices against the three maturity levels to capture the current state
- Perform gap analysis by comparing current scores against target maturity goals
- Build a prioritized roadmap of activities to close gaps over successive iterations
- Re-assess periodically to track progress and demonstrate measurable improvement
- Optionally contribute anonymized results to SAMM Benchmarking to compare against peers
How it is used
SAMM is designed to be used iteratively rather than as a one-time audit. A typical adoption starts by measuring the organization's current software security posture, then setting realistic target maturity levels based on business risk, and finally building an improvement roadmap that sequences activities into achievable phases. Successive iterations raise maturity where it matters most.
- Benchmark current capability and identify the weakest practices to prioritize
- Define a target maturity profile aligned to the organization's risk appetite
- Drive and govern an enterprise AppSec program with a common, shared vocabulary
- Compare maturity against industry peers and report progress to leadership
History
SAMM began as OpenSAMM 1.0, created by Pravir Chandra and released in 2009. The project subsequently moved under OWASP and evolved through the 1.x line (including v1.5). In February 2020 the project team published SAMM v2.0, a full rewrite that introduced the Streams concept and restructured the practices, with the model maintained at v2.0.3 (2022). The framework is published under the CC BY-SA 4.0 license and developed openly with community contributions.