September 2, 2025 - Some notable examples of companies that use BSIMM include Lenovo, Bank of America and Johnson & Johnson. The framework is particularly popular among large enterprises with mature software development lifecycles (SDLCs) that require tailored ...

BSIMM is a descriptive census of what programs already do. SF² sequences a practice baseline, and that census is one snapshot of it rather than a fixed target.

March 26, 2025 - Take the example of a healthcare company prioritizing "Privacy Engineering" to comply with regulations. By using the BSIMM framework, strategic planning becomes not just a checklist but a journey towards robust, context-aware security practices.

March 12, 2026 - The Building Security In Maturity Model (better known as the BSIMM) is a descriptive model that provides a baseline of observed activities for software security initiatives.

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

October 29, 2020 - We like to say we visited a neighborhood to see what was happening and observed that “there are robot vacuum cleaners in X of the Y houses we visited.” Note that the BSIMM does not say, “all houses must have robot vacuum cleaners,” “robots ...

January 5, 2025 - Alright, let's get into the nitty-gritty of what BSIMM really is. Picture it as a map. A map that guides companies on how to build secure software. It's not just any map, though. It's crafted from real-world data. Data collected from companies that are already doing a great job at keeping their software safe.

December 12, 2025 - Unlike compliance frameworks that prescribe specific controls, BSIMM documents what organizations actually do to achieve software security maturity—making it particularly valuable for vendors who need to demonstrate credible security practices to enterprise clients while meeting data protection obligations under frameworks like ISO 27001, SOC 2, and GDPR.

A concrete example of this · could be an organisation that develops and runs a service that runs in the cloud. In this case, activity SE2.4 “Use code signing” does not make sense, since the · source or binaries are never transferred out of the organisation’s cloud.

Software Confidence. Achieved · Building Security In

We have added a few activities. I gave you an example of bug bounties. We've actually added · that into the model. And we track that directly because we saw it begin to emerge. And so, the · BSIMM, as a description of the space, really does adjust to describe the real world out there.

In 2008 the speakers, with Sammy Migues, interviewed executives running nine initiatives, using the twelve practices of the Software Security Framework as our guide. Those companies among the nine who graciously agreed to be identified include Adobe, The Depository Trust and Clearing Corporation (DTCC), EMC, Google, Microsoft, QUALCOMM, and Wells Fargo. The resulting data, drawn from real programs at different levels of maturity, was used to guide the construction of the Building Security in Maturity Model. This talk will describe the maturity model, drawing examples from many real software security programs.

September 19, 2022 - into a software security framework (SSF), represented in Figure 7. The SSF is organized into four domains—Governance, Intelligence, SSDL Touchpoints, and Deployment—with those domains currently · embracing 125 activities. The Governance domain, for example, includes activities that fall under the organization, management, and ... BSIMM terminology.

May 20, 2019 - The BSIMM employs a framework of 116 activities categorized into 12 practices allowing organizations to quantitatively assess their security maturity over time.

April 25, 2024 - The BSIMM11 report provides interesting insights into the state-of-the-art security practices in place in the software industry. It also outlines a framework, based on observing companies at each stage of maturity, for organization to follow who are looking to mature their practices.

The Building Security In Maturity Model (BSIMM) is a framework and benchmarking tool designed to assist organizations in understanding and improving their software security initiatives. Rather than providing a checklist or a one-size-fits-all solution, BSIMM acts as a mirror, reflecting the software security practices adopted by leading organizations.

We have added a few activities. I gave you an example of bug bounties. We've actually added · that into the model. And we track that directly because we saw it begin to emerge. And so, the · BSIMM, as a description of the space, really does adjust to describe the real world out there.

February 13, 2024 - The Building Security In Maturity Model (BSIMM) is a powerful tool that organizations can use to assess the maturity of their software security initiatives. It's not just a theoretical model—it's based on the real-world practices of top companies. I was fortunate enough to be involved in leading our company's BSIMM assessments in 2021 and 2022.

is captured and described in BSIMM. As an organizing feature, we introduce and use a Software Security Framework