What it covers. SAMM is an OWASP model for assessing and improving an organisation's software security practices. Version 2 is organised into five business functions, Governance, Design, Implementation, Verification and Operations, each containing three security practices with maturity levels from one to three. It is technology and process neutral, so it can be applied to agile, waterfall or mixed environments.
In practice. Organisations assess their current maturity across the practices, set realistic targets based on risk and business priorities and build a phased roadmap. Assessments are repeated to track progress. Evidence includes scored assessments, a roadmap with owners, and artefacts behind each practice, such as threat models, security requirements, test results and incident handling records.
Common gaps. Assessments are sometimes scored generously by interview without checking artefacts. Targets are also often set at the highest level everywhere instead of according to risk.