thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Software Assurance Maturity Model (SAMM)

OWASP's open framework for assessing and improving an organization's software security posture across five business functions.

Definition

OWASP SAMM v2 defines five business functions (Governance, Design, Implementation, Verification, Operations), each with three security practices measured at maturity levels 1 to 3. Organizations score their current state, set a target and build a roadmap. It is prescriptive, unlike the descriptive BSIMM.

Example

A company runs a SAMM assessment and finds its Verification function weakest, then funds a security testing program.

Exam tip

SAMM is prescriptive (what you should do); BSIMM is descriptive (what other organizations actually do).

Related terms