OWASP SAMM

Governance — Strategy & Metrics

Define application security strategy aligned with business goals — executive sponsorship, security metrics, and KPI reporting for the AppSec programme.

Governance — Policy & Compliance

Security policies for software development — coding standards, security requirements library, and compliance monitoring across the development portfolio.

Design — Threat Assessment

Systematic threat modelling for applications — attack library, threat profiles, and risk-driven design security decisions.

Design — Security Architecture

Secure architecture patterns library — approved design patterns, architecture review process, and security reference architectures for common use cases.

Implementation — Secure Build

Secure build pipeline — SAST integration, dependency management (SCA), build artifact signing, and secure dependency repositories.

Implementation — Secure Deployment

Secure deployment practices — configuration management, secret management, infrastructure-as-code security, and deployment verification.

Verification — Security Testing

Security testing programme — DAST, penetration testing, bug bounty, and regression testing for security fixes.

Operations — Incident Management

Security incident detection and response for production applications — monitoring, alerting, and structured incident response for application-layer events.