This document provides an executive summary and table of contents for the BSIMM12 2021 Insights & Trends Report. The report examines software security activities from 128 organizations across various industries. Key findings include the top 10 software security activities, comparisons of activities between industries like financial services and healthcare, and emerging trends in areas like DevSecOps practices, governance-as-code, and continuous security improvement.

Security maintainance of deployed software systems, including "penetrate-and-patch", vulnerability enumeration (CVE IDs) and classification (CWE taxonomy). Software security lifecycles and security activities (e.g., as in BSIMM).

February 13, 2026 - Throughout the evaluation, assessors map your activities to the BSIMM framework’s maturity levels. The assessment delivers a comprehensive scorecard showing which of the 128 activities your organization currently performs, your maturity level within each of the 12 practices, and how you compare ...

December 11, 2023 - The BSIMM14 “skeleton” contains 126 activities organized under 12 practices that are in turn grouped under four domains. And the report doesn’t dictate exactly which activities your organization should implement to improve its software ...

the first time healthcare organizations have been part of the BSIMM data set, can you talk · about the significance of that and possibly why compliance regulations like HIPAA haven't ... Gary McGraw: Sure. Regulation and compliance is very tricky. And it's important to talk about. And in fact, one of the practices, one of the 12 practices in the BSIMM, is about compliance

February 3, 2016 - The best way to use the BSIMM is to compare and contrast your own initiative with the data about what other organizations are doing as described in the model. You can then identify goals and objectives and refer to the BSIMM to determine which additional activities make sense for you. The BSIMM data show that high maturity initiatives are well-rounded—carrying out numerous activities in all 12 of the practices ...

May 20, 2019 - Historically, penetration testing used to identify vulnerabilities in isolation, but recent trends show a shift towards integrating security practices within continuous development cycles, such as CI/CD and DevOps. This evolution indicates an urgent need for adaptive security measures that evolve alongside rapid technological advancements. In which industries have software security initiatives advanced most significantly?add · The BSIMM has noted substantial improvements in regulated industries, particularly financial services, which showcased an average SSG maturity of 5.4 years compared to just 2.5 years in healthcare firms.

the first time healthcare organizations have been part of the BSIMM data set, can you talk · about the significance of that and possibly why compliance regulations like HIPAA haven't ... Gary McGraw: Sure. Regulation and compliance is very tricky. And it's important to talk about. And in fact, one of the practices, one of the 12 practices in the BSIMM, is about compliance

September 19, 2022 - FIGURE 1. THE BSIMM SKELETON. Within the SSF, the 125 activities are organized into the 12 BSIMM practices, which are within four domains.

Based on research with companies such as Aetna, HSBC, Cisco and more, the Building Security In Maturity Model (BSIMM) measures software security.

Software Confidence. Achieved · Building Security In

We cannot provide a description for this page right now

Practice. A grouping of BSIMM activities. The SSF is · organized into 12 practices, three in each of four domains.

September 2, 2025 - The Building Security In Maturity Model (BSIMM) operates as an observational framework designed to evaluate and improve an organization’s software security initiatives. At its core, BSIMM defines a Software Security Framework (SSF) of 12 practices across four domains.

The document summarizes the Building ... security practices across organizations. It presents the BSIMM8 model based on data from 109 software security initiatives. The BSIMM can be used by organizations to measure their own initiatives and identify goals and additional activities. High maturity initiatives perform numerous activities across all 12 practices ...

the first time healthcare organizations have been part of the BSIMM data set, can you talk · about the significance of that and possibly why compliance regulations like HIPAA haven't ... Gary McGraw: Sure. Regulation and compliance is very tricky. And it's important to talk about. And in fact, one of the practices, one of the 12 practices in the BSIMM, is about compliance

November 22, 2025 - BSIMM collects information from around 128 firms spanning several business categories. The core of the BSIMM framework consists of 122 tasks divided into 12 practices that are organized into four domains:

he Building Security In Maturity Model (BSIMM) described in this document is designed to help you understand

It describes observed practice but does not recommend what organizations ... BSIMM is available for anyone to use under the Creative Commons license and is available for download from the · BSIMM web site. BSIMM is primarily intended for people who are leading a software security group or initiative ... The BSIMM Software Security Framework (SSF) comprises 12 practices that represent aggregations of 109 observed

October 6, 2021 - Those activities are grouped into 12 practices that are, in turn, grouped into 4 domains: governance, intelligence, secure software development life cycle (SSDL) touchpoints, and deployment.