Markdown Editor
Open the editor

Application Security Program Kit

Run an AppSec programme: SAMM maturity, Secure by Design roadmap, SSDF evidence, security champions, threat models, reviews, pentests and PSIRT.

Step 1

Strategy

  1. OWASP SAMM Assessment Template

    Full

    OWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics

    OWASP SAMM v2 (core v2.2.0)

  2. Secure by Design Roadmap Template (CISA Pledge)

    Full

    Secure by Design roadmap: executive owner, 3 principles, 7 pledge goals with measures, memory-safety roadmap, bad practices check, evidence, reporting

    CISA Secure by Design (Oct 2023); Secure by Design Pledge (May 2024)

  3. SSDF Self-Assessment and Attestation Template (NIST SP 800-218)

    Full

    SSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation

    NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A
Step 2

Practice

  1. Security Champions Programme Charter Template (OWASP)

    Full

    Security champions charter: vision, goals, selection, time allocation, training path, duties, rituals, metrics, recognition, rotation, OWASP and SAMM mapping

    OWASP Security Champions Guide; OWASP SAMM v2 Education and Guidance

  2. Secure Coding Standard Template

    Standard

    Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process

Step 3

Threat modelling

  1. Threat Model Template (STRIDE)

    Full

    STRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance

    STRIDE
Step 4

Verification

  1. Security Design Review Template (OWASP ASVS 5.0)

    Full

    Design-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off

    OWASP ASVS 5.0

  2. Penetration Test Report Template (PTES, OWASP WSTG)

    Full

    Pentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest

    PTES; OWASP Web Security Testing Guide
Step 5

Assessments

  1. Supplier Security Assessment Template

    Standard

    Vendor vetting + ongoing monitoring

Step 6

Incidents

  1. PSIRT Vulnerability Handling Procedure Template (ISO/IEC 30111, CVSS v4)

    Full

    Producer-side PSIRT procedure: intake, verification, CVSS v4.0, EPSS, KEV and SSVC triage, remediation targets, advisory and VEX, CVE/CNA, CRA Art. 14, metrics

    ISO/IEC 30111:2019 (structure); CVSS v4.0; CISA SSVC; CNA Rules 4.2.0; EU CRA Art. 14