February 23, 2026 - Descriptive rather than prescriptive, BSIMM is not a how-to guide. Its goal is to help you determine where your program stands today and how best to enhance it. However, it emphasizes alignment with its control set as a way to achieve software security. Also dating to 2009, SAMM is an effort to “take software security to the next level” by combining an industry proven maturity standard with the wealth of OWASP resources, especially its Application Security Verification Standard (ASVS).

October 29, 2020 - OWASP SAMM provides a number of templates for typical organizations to this end, but we recommended that you adapt these to the needs of your organization. [4] “The BSIMM is not a traditional maturity model where a set of activities are repeated at multiple levels of depth and breadth—do something at level 1, do it more at level 2, do it better at level 3, and so on.

December 10, 2024 - Building Security In Maturity Model (BSIMM) Mapped to OWASP SAMM The full mapping sheet between BSIMM 14 and OWASP SAMM. Introduction The Building Security In Maturity Model (BSIMM) and OWASP Software Assurance Maturity Model (SAMM) share a common history. Both were conceived around 2008-2009 and are based on OpenSAMM, which was created by Pravir Chandra.

September 2, 2025 - The split allowed OWASP SAMM to serve as a free resource for organizations of all sizes, while BSIMM focused on providing in-depth data and tailored guidance as part of a paid framework.

October 1, 2025 - The remainder of this blog focuses on two maturity models that originate from the same source, i.e., OpenSAMM. OpenSAMM was created by Pravir Chandra and sponsored by Fortify. Fortify has then donated OpenSAMM to the OWASP community. Both BSIMM and SAMM originate from OpenSAMM.

November 7, 2025 - In summary, the goal of OWASP SAMM is to provide a prescriptive framework for helping organizations implement structured, risk-based software security strategies, while the goal of BSIMM is to serve as an empirical model built from more than 100 real-world software security initiatives.

September 9, 2025 - Like all OWASP projects, SAMM is ... and versatile. Unlike BSIMM, SAMM is prescriptive, meaning it prescribes specific actions and practices organizations can take to improve their software assurance....

December 30, 2021 - Each function includes three security practices, and each security practice contains three levels of maturity. One of the major differences between SAMM and BSIMM is that SAMM is a prescriptive model, whereas BSIMM is descriptive.

September 26, 2025 - BSIMM - https://www.bsimm.com/ OWASP SAMM – https://owaspsamm.org BSIMM (Building Security In Maturity Model) and SAMM (Software Assurance Maturity Model) have similar origins dating back to a common origin back in 2008-2009.

January 17, 2016 - In assessing organizations that ... on the assessment data in each study. OpenSAMM is a prescriptive model that is maintained by the Open Web Application Security Project (OWASP)....

1 month ago - The consolidated list of software and data requirements are yielded from compliance audit results as OWASP (2018) points out, and these lists should be expanded to create a response statement for each requirement or a control statement. The audit process includes verifying each control statement for adequacy and measuring the organization against the control statements. It is important that they accurately signify actual organization practices. The BSIMM area, “Unify Regulatory Pressures Similarly” (CP1.1), as described by McGraw et al.

July 23, 2025 - The model evolves yearly with updates from over a hundred firms. SAMM was developed by OWASP in 2009 as a flexible framework to integrate software security into existing processes.

January 29, 2025 - Elzar characterizes the SSDF as non-prescriptive, while OWASP SAMM and BSIMM as “maturity models” are much more prescriptive on what to do and how to do it.

Both OWASP SAMM and BSIMM are maturity ... against a set of practices. While SAMM provides a set of community-curated practices, BSIMM practices are derived from an annual industry survey....

September 20, 2019 - SAMM is measuring maturity against a prescriptive set of practices whereas BSIMM allows you to measure the maturity of your organisation relative to its peers.

April 8, 2024 - The model consists of 12 domains, ... 2.0: SSE-CMM and DSOMM focus on security engineering and DevSecOps capabilities, while BSIMM and OWASP SAMM 2.0 focus on software security initiatives....

June 15, 2012 - GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

Software Assurance Maturity Model · Principal Solutions Engineer, Snyk