thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Building Security In Maturity Model (BSIMM)

A descriptive software security maturity model built from observing the real practices of participating organizations.

Definition

BSIMM, published annually (now maintained by Black Duck, formerly Synopsys), catalogs observed software security activities across four domains: Governance, Intelligence, SSDL Touchpoints and Deployment. Organizations compare themselves to peers rather than to an ideal. It is useful for benchmarking a software security initiative.

Example

A CISO benchmarks the firm's software security initiative against BSIMM data for the financial services vertical.

Exam tip

BSIMM describes what peers do; it does not tell you what you must do, which is SAMM's role.

Related terms