OWASP SAMM Assessment Template

OWASP SAMM Assessment: [Organisation or assessment scope]

Maturity assessment of a software security programme using the OWASP Software Assurance Maturity Model (SAMM) version 2: five business functions, fifteen security practices, two streams per practice and three maturity levels. The template records the scope, the scoring method, current and target scores, findings and a phased improvement roadmap. Model structure as published at owaspsamm.org (model v2; core release v2.2.0, July 2026). The assessment prompts in section 4 are original wording written for this template, not the official SAMM questionnaire; use the SAMM Toolbox if you need the official questions. Worked examples use Corvid Commerce, a fictional SaaS company. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Introduction and scope
2. The SAMM model
3. Assessment method
4. Assessment prompts
5. Current maturity scores
6. Target maturity
7. Findings
8. Improvement roadmap
9. Metrics and tracking
10. Governance and reassessment
11. Mapping to other frameworks
12. Glossary and references

1. Introduction and scope

1.1 Purpose and drivers

1.2 Scope

1.3 Assessment approach

Choose one approach and keep it for later cycles:

• Interview-based: facilitated sessions with practice owners and a sample of teams; answers recorded with the interviewee role. Fast; less rigorous.
• Evidence-based: each answer supported by an artefact reference (EVD-NNN). Slower; suitable when results are shared with customers or auditors.
• Hybrid (recommended): interviews for all streams, evidence for any answer at or above "at least half".

Example: Corvid Commerce used the hybrid approach, with 14 interviews and 62 evidence items.

2. The SAMM model

SAMM v2 organises software security into five business functions. Each function has three security practices. Each practice has two streams (A and B) that progress through three maturity levels. Level 1 is an initial, ad hoc implementation; level 2 is a structured, more efficient one; level 3 is comprehensive and optimised. This template uses the identifiers from the SAMM core model files, for example G-SM-A for Governance, Strategy and Metrics, stream A.

SAMM also describes an improvement cycle of six steps: Prepare, Assess, Set the Target, Define the Plan, Implement and Roll Out. Sections 1 to 5 of this template cover Prepare and Assess, section 6 sets the target, and sections 8 and 9 define, implement and roll out the plan.

3. Assessment method

3.1 Roles

R = Responsible, A = Accountable, C = Consulted, I = Informed.

3.2 Evidence rules

1. Record one answer per stream per level, with the interviewee role and, for answers above "some", at least one evidence reference.
2. Answer for the whole scope. When teams differ, the answer reflects the share of the scope that meets the prompt.
3. Do not credit planned or piloted activity unless it operates for the share claimed.
4. Note quality concerns in the findings even when the activity exists (for example, threat models that are never updated).

3.3 Answer scale and scoring

Each prompt in section 4 is answered on a four-step coverage scale:

Formulas.

• Stream score = L1 value + L2 value + L3 value (range 0 to 3).
• Practice score = (stream A score + stream B score) / 2 (range 0 to 3).
• Business function score = mean of its three practice scores.
• Overall score = mean of the fifteen practice scores.

This additive approach follows the spreadsheet-style scoring used by the SAMM Toolbox, which publishes answer sets with values of 0, 0.25, 0.5 and 1. Check owaspsamm.org/assessment for the current Toolbox and its rules before comparing your scores with other organisations.

Optional gating rule. Some assessors credit a higher level only when the lower level scores at least 0.5. If you apply the rule, state it here and apply it in every cycle: [Applied / Not applied].

3.4 Calibration

Hold a calibration session after interviews. For each stream, the assessor presents the proposed answers and evidence; practice owners may challenge. Record changed answers and the reason. Target a variance of no more than one answer step between assessors scoring the same stream.

4. Assessment prompts

Each row gives one prompt per maturity level for a stream. Answer each prompt on the scale in section 3.3.

4.1 Governance

4.2 Design

4.3 Implementation

4.4 Verification

4.5 Operations

5. Current maturity scores

5.1 Stream answers and practice scores

Example answers for Corvid Commerce. L1, L2 and L3 columns show answer values for stream A / stream B.

Practice scores are shown to two decimals; exact values are multiples of 0.125 (for example G-PC = (1.5 + 0.75) / 2 = 1.125).

5.2 Business function summary

Example reading: Corvid Commerce is strongest in Implementation, where pipeline automation is mature, and weakest in Verification, where design validation and requirements-based testing are largely ad hoc.

6. Target maturity

Example targets for the next 18 months.

Target by business function (Example): Governance 1.67, Design 1.50, Implementation 2.17, Verification 1.25, Operations 1.58.

7. Findings

8. Improvement roadmap

8.1 Phases

8.2 Roadmap items

The chart uses Example dates; replace them with your plan.

9. Metrics and tracking

10. Governance and reassessment

• The CISO owns the SAMM programme and approves targets and the roadmap.
• The AppSec lead runs assessments, maintains this document and reports progress quarterly to the [engineering leadership forum].
• Practice owners are named per practice in the roadmap and own the actions for their streams.
• Reassess the full model every [12] months and at the end of each roadmap phase. A lightweight re-score of the streams touched by a phase is acceptable between full assessments; mark it as partial.
• Keep the method in section 3 unchanged between cycles. If you must change it, rescore the previous cycle with the new method before comparing.
• Check the SAMM site for new model releases before each cycle. If stream definitions change, record the change and its effect on comparability.

11. Mapping to other frameworks

The SSDF mapping above is this template's own indicative mapping at practice level. SP 800-218 also lists OWASP SAMM references for many tasks in its References column (for example "OWASPSAMM: PC1-A, PC1-B, PC2-A" for PO.1.1). Those references cite SAMM version 1.5 (2017), not SAMM v2, so the codes use the version 1.5 practice abbreviations and activity IDs. Compare with those references before reusing evidence, and translate them with the indicative crosswalk below.

RV.3.4 cites SAMM without an activity code. When the SSDF moves to a new final version (SP 800-218r1 is a draft as of October 2026), check whether its references have been updated to SAMM v2 before relying on this table.

12. Glossary and references

12.1 Glossary

12.2 References

Standard and licence note

Structure aligned with the OWASP Software Assurance Maturity Model (SAMM) version 2, core release v2.2.0 (July 2026), by the OWASP Foundation and the SAMM project team, published at owaspsamm.org under the Creative Commons Attribution-ShareAlike 4.0 International licence (CC BY-SA 4.0). Business function, security practice and stream names and identifiers are taken from the SAMM model; the stream descriptions, assessment prompts, scoring narrative, worked examples and roadmap are original and do not reproduce the SAMM questionnaire. ShareAlike: if you redistribute material adapted from SAMM (for example the model table in section 2), attribute OWASP SAMM, link to the licence, indicate changes and license the adapted SAMM material under CC BY-SA 4.0. Check the current model and Toolbox at owaspsamm.org before each assessment, as stream definitions and answer sets may change. Corvid Commerce is a fictional company. Original text written for this collection. Template licence: MIT.