アプリケーションセキュリティプログラムキット
AppSecプログラムの運営：SAMM成熟度、Secure by Designロードマップ、SSDFエビデンス、セキュリティチャンピオン、脅威モデル、レビュー、ペネトレーションテスト、PSIRT。
戦略
OWASP SAMM Assessment Template
フルOWASP SAMM v2 assessment: 15 practices and 30 streams, original prompts per level, scoring formulas, current vs target scores, findings, phased roadmap, metrics
OWASP SAMM v2 (core v2.2.0)Secure by Design Roadmap Template (CISA Pledge)
フルSecure by Design roadmap: executive owner, 3 principles, 7 pledge goals with measures, memory-safety roadmap, bad practices check, evidence, reporting
CISA Secure by Design (Oct 2023); Secure by Design Pledge (May 2024)SSDF Self-Assessment and Attestation Template (NIST SP 800-218)
フルSSDF 1.1 self-assessment by task (PO, PS, PW, RV), status scale and scoring, evidence, POA&M, exceptions, v1.2 draft and AI profile supplements, attestation
NIST SP 800-218 SSDF 1.1; SP 800-218r1 ipd; SP 800-218A
演習
Security Champions Programme Charter Template (OWASP)
フルSecurity champions charter: vision, goals, selection, time allocation, training path, duties, rituals, metrics, recognition, rotation, OWASP and SAMM mapping
OWASP Security Champions Guide; OWASP SAMM v2 Education and GuidanceSecure Coding Standard Template
標準Secure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
脅威モデリング
検証
Security Design Review Template (OWASP ASVS 5.0)
フルDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 5.0Penetration Test Report Template (PTES, OWASP WSTG)
フルPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide