Software Assurance Maturity Model (SAMM)
The Software Assurance Maturity Model (SAMM) helps organizations assess and improve their software security practices. Because SAMM is a maturity model rather than a certification, compliance means scoring your current practices against its defined maturity levels and choosing where to improve next.
Maturity levels
SAMM organizes software security into five business functions: Governance, Design, Implementation, Verification, and Operations. Each function contains three security practices, and each practice defines three maturity levels, progressing from initial ad hoc activity at level 1 to comprehensive, measured practice at level 3. A score of 0 means the practice is not performed.
To assess itself, a team answers the assessment questions for each practice and records a score from 0 to 3 per practice. The team then sets a target score for each practice based on its risk profile, builds an improvement roadmap to close the gaps between current and target scores, and reassesses on a regular cadence to measure progress.