The OWASP SAMM Model and Structure

At the highest level, SAMM defines five business functions. Each business function is a category of activities that any organization involved with software development must fulfill to some degree.

Each business function has three security practices, areas of security-related activities that build assurance for the related business function.

Security practices have activities, grouped in logical flows and divided into two streams. Streams cover different aspects of a practice and have their own objectives, aligning and linking the activities in the practice over the different maturity levels.

For each security practice, SAMM defines three maturity levels. Each level has a successively more sophisticated objective with specific activities, and more strict success metrics.

The structure and setup of the SAMM model support

1. the assessment of the organization’s current software security posture
2. the definition of the organization’s target
3. the definition of an implementation roadmap to get there
4. prescriptive advice on how to implement particular activities