Software Assurance Maturity Model (SAMM)

The Software Assurance Maturity Model version 1.0 was released on Wednesday after a recent period of review and updating.

The Software Assurance Maturity Model (SAMM) describes a reasonable and practical approach to building security into the software development lifecycle, for organisations of all sizes. The model, available as a free PDF download, can be used with a particular software project, software development team or a whole software development company.

SAMM specifies four business functions (governance, construction, verification and deployment) critical to building security in, each with three security practices. Within the twelve security practices SAMM defines three maturity levels as objectives, each with more stringent success metrics than the previous level. The security practices can be improved independently, giving a maturity fingerprint snapshot across the business functions.

One of the best uses will be to compare existing practices against the framework—and then choosing activities to improve which suit the particular organisation's culture and needs. SAMM is not prescriptive in how it can be used.

Additionally, the document is extremely well-designed making the content much more accessible than many others. Join the project mailing list if you want to contribute to its continuing development.