Measure your software assurance maturity performance using the SAMM assessment toolbox.

A Software Assurance Maturity Model (SAMM) that provides an effective and measurable way for all types of organizations to analyse and improve their software security posture.

You use certification programs or attendance records to determine access to development systems and resources ... Complete this Google Form with guidance for this stream. To learn more about stream guidance for the SAMM model, see the Stream guidance page.

The questions follow the order of the SAMM assessment sheet 2.0, but with a slight change for a more natural flow. Concretely, Education & Guidance comes after Secure Architecture. See the example here . The initial version of this assessment guide was provided by Rob van der Veer, based on the assessment experience of the Software Improvement Group. OWASP ...

April 22, 2024 - Compared to standards such as PA-DSS4 and TOGAF,5 SAMM does not offer certification, nor does it specify detailed coding of threats as in OWASP AVSV6 or SAFECode.7 Nevertheless, SAMM is more focused on risk management and training, presenting ...

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

Measure and improve your organization's software security posture

Spreadsheets and online tools for conducting SAMM assessments

April 4, 2025 - SAMMY turns this into a continuous process. Either way situations will have to be assessed, benchmarked and analyzed. There are several ways you can go about this, self assessment, external assessment and validation audits. ... Self assessment is the quickest and most accessible way to get started with OWASP SAMM.

May 31, 2026 - It is a framework. There is no formal OWASP SAMM certification.

A great deep-dive into the SAMM model that gives actionnable inputs and valuable data to start an assessment. Thanks to the Core team!

A fully free, self-paced course with over 5 hours of video content. Visit the SAMM Fundamentals Course page on Thinkific. We’d really appreciate feedback on this first version of the course. Please use our Slack channel , the Discussions on GitHub or our contact form.

The Security Testing (ST) practice ... applications, in-depth testing based on good knowledge of an application and its business logic is often only possible via slower, manual expert security testing....

February 20, 2026 - What to review in postmortems related to OWASP SAMM · Which SAMM domains failed to prevent the incident. SLI/SLO behavior during the incident. Runbook effectiveness and on-call performance. Roadmap items to raise maturity in deficient areas. None required. To provide a measurable roadmap for improving software security practices across an organization. No. It is a maturity model and program framework, not a compliance certification.

NIST promotes U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

On the pen testing side of things there is already a Crest certification called OVS that pen testers / pen testing companies can achieve that shows they understand how to test against the standard. Once developers know how to build a secure thing, they need to understand how to do so in concert with others. The broader picture of this is the maturity level of the team performing all the security aspects of the greater SSDLC - and when we say SSDLC at OWASP, we mean OWASP SAMM...

January 30, 2025 - OWASP SAMM lets you score your application security practices on a 1-to-3 scale, with 3 being most mature. You can use a decimal place after a score to fine-tune it (e.g., 1.5, 2.9, etc.). At the end of an assessment, SAMM helps you evaluate ...

Security gap analysis can benefit from an assessment which measures the quality of the software assurance maturity process. The SAMM Assessment tools include spreadsheets and online tools such as SAMMwise and SAMMY.