The questions of the SAMM assessment, one for each activity, with the criteria for a positive answer and the possible answers.

Sottokwistjonijiet

Links
G-SM-1-A Do you understand the enterprise-wide risk appetite for your applications?

Question: Do you understand the enterprise-wide risk appetite for your applications?

Quality criteria

  • You capture the risk appetite of your organization's executive leadership
  • The organization's leadership vets and approves the set of risks
  • You identify the main business and technical threats to your assets and data
  • You document risks and store them in an accessible location

Answers

  • No (0)
  • Yes, it covers general risks (0.25)
  • Yes, it covers organization-specific risks (0.5)
  • Yes, it covers risks and opportunities (1)
G-SM-2-A Do you have a strategic plan for application security and use it to make decisions?

Question: Do you have a strategic plan for application security and use it to make decisions?

Quality criteria

  • The plan reflects the organization's business priorities and risk appetite
  • The plan includes measurable milestones and a budget
  • The plan is consistent with the organization's business drivers and risks
  • The plan lays out a roadmap for strategic and tactical initiatives
  • You have buy-in from stakeholders, including development teams

Answers

  • No (0)
  • Yes, we have a plan that can be used for decision making (0.25)
  • Yes, we consult the plan before making significant decisions (0.5)
  • Yes, we consult the plan often, and it is aligned with our application security strategy (1)
G-SM-3-A Do you regularly review and update the Strategic Plan for Application Security?

Question: Do you regularly review and update the Strategic Plan for Application Security?

Quality criteria

  • You review and update the plan in response to significant changes in the business environment, the organization, or its risk appetite
  • Plan update steps include reviewing the plan with all the stakeholders and updating the business drivers and strategies
  • You adjust the plan and roadmap based on lessons learned from completed roadmap activities
  • You publish progress information on roadmap activities, making sure they are available to all stakeholders

Answers

  • No (0)
  • Yes, but review is ad-hoc (0.25)
  • Yes, we review it regularly (0.5)
  • Yes, we review it continuously (1)
G-SM-1-B Do you use a set of metrics to measure the effectiveness and efficiency of the application security program across applications?

Question: Do you use a set of metrics to measure the effectiveness and efficiency of the application security program across applications?

Quality criteria

  • You document each metric, including a description of the sources, measurement coverage, and guidance on how to use it to explain application security trends
  • Metrics include measures of effort, results, and environment measurement categories
  • Most of the metrics are frequently measured, easy or inexpensive to gather, and expressed as a cardinal number or a percentage
  • Application security and development teams publish metrics

Answers

  • No (0)
  • Yes, for one metrics category (0.25)
  • Yes, for two metrics categories (0.5)
  • Yes, for all three metrics categories (1)
G-SM-2-B Have you defined Key Performance Indicators (KPIs) from available application security metrics?

Question: Have you defined Key Performance Indicators (KPIs) from available application security metrics?

Quality criteria

  • You define KPIs after gathering enough information to establish realistic objectives
  • You develop KPIs with buy-in from the leadership and teams responsible for application security
  • KPIs are available to the application teams and include acceptability thresholds and guidance in case teams need to take action
  • Success of the application security program is clearly visible based on defined KPIs

Answers

  • No (0)
  • Yes, for some of the metrics (0.25)
  • Yes, for at least half of the metrics (0.5)
  • Yes, for most or all of the metrics (1)
G-SM-3-B Do you update the Application Security strategy and roadmap based on application security metrics and KPIs?

Question: Do you update the Application Security strategy and roadmap based on application security metrics and KPIs?

Quality criteria

  • You review KPIs at least yearly for their efficiency and effectiveness
  • KPIs and application security metrics trigger most of the changes to the application security strategy

Answers

  • No (0)
  • Yes, but review is ad-hoc (0.25)
  • Yes, we review it regularly (0.5)
  • Yes, we review it continuously (1)
G-PC-1-A Do you have and apply a common set of policies and standards throughout your organization?

Question: Do you have and apply a common set of policies and standards throughout your organization?

Quality criteria

  • You have adapted existing standards appropriate for the organization’s industry to account for domain-specific considerations
  • Your standards are aligned with your policies and incorporate technology-specific implementation guidance

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
G-PC-2-A Do you publish the organization's policies as test scripts or run-books for easy interpretation by development teams?

Question: Do you publish the organization's policies as test scripts or run-books for easy interpretation by development teams?

Quality criteria

  • You create verification checklists and test scripts where applicable, aligned with the policy's requirements and the implementation guidance in the associated standards
  • You create versions adapted to each development methodology and technology the organization uses

Answers

  • No (0)
  • Yes, some content (0.25)
  • Yes, at least half of the content (0.5)
  • Yes, most or all of the content (1)
G-PC-3-A Do you regularly report on policy and standard compliance, and use that information to guide compliance improvement efforts?

Question: Do you regularly report on policy and standard compliance, and use that information to guide compliance improvement efforts?

Quality criteria

  • You have procedures (automated, if possible) to regularly generate compliance reports
  • You deliver compliance reports to all relevant stakeholders
  • Stakeholders use the reported compliance status information to identify areas for improvement

Answers

  • No (0)
  • Yes, but reporting is ad-hoc (0.25)
  • Yes, we report at regular times (0.5)
  • Yes, we report continuously (1)
G-PC-1-B Do you have a complete picture of your external compliance obligations?

Question: Do you have a complete picture of your external compliance obligations?

Quality criteria

  • You have identified all sources of external compliance obligations
  • You have captured and reconciled compliance obligations from all sources

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
G-PC-2-B Do you have a standard set of security requirements and verification procedures addressing the organization's external compliance obligations?

Question: Do you have a standard set of security requirements and verification procedures addressing the organization's external compliance obligations?

Quality criteria

  • You map each external compliance obligation to a well-defined set of application requirements
  • You define verification procedures, including automated tests, to verify compliance with compliance-related requirements

Answers

  • No (0)
  • Yes, for some obligations (0.25)
  • Yes, for at least half of the obligations (0.5)
  • Yes, for most or all of the obligations (1)
G-PC-3-B Do you regularly report on adherence to external compliance obligations and use that information to guide efforts to close compliance gaps?

Question: Do you regularly report on adherence to external compliance obligations and use that information to guide efforts to close compliance gaps?

Quality criteria

  • You have established, well-defined compliance metrics
  • You measure and report on applications' compliance metrics regularly
  • Stakeholders use the reported compliance status information to identify compliance gaps and prioritize gap remediation efforts

Answers

  • No (0)
  • Yes, but reporting is ad-hoc (0.25)
  • Yes, we report at regular times (0.5)
  • Yes, we report continuously (1)
G-EG-1-A Do you require employees involved with application development to take SDLC training?

Question: Do you require employees involved with application development to take SDLC training?

Quality criteria

  • Training is repeatable, consistent, and available to anyone involved with software development lifecycle
  • Training includes relevant content from the latest OWASP Top 10 and covers concepts such as Least Privilege, Defense-in-Depth, Fail Secure (Safe), Complete Mediation, Session Management, Open Design, and Psychological Acceptability
  • Training requires a sign-off or an acknowledgement from attendees
  • You have reviewed the training content within the last 12 months, and have completed any required updates
  • All new covered staff are required to complete training during their onboarding process
  • Existing covered staff are required to complete training when content is added/revised, or complete refresher training at least every 24 months, whichever comes first

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
G-EG-2-A Is training customized for individual roles such as developers, testers, or security champions?

Question: Is training customized for individual roles such as developers, testers, or security champions?

Quality criteria

  • Training includes all topics from maturity level 1, and adds more specific tools, techniques, and demonstrations
  • Training is mandatory for all employees and contractors
  • Training includes input from in-house SMEs and trainees
  • Training includes demonstrations of tools and techniques developed in-house
  • You use feedback to enhance and make future training more relevant

Answers

  • No (0)
  • Yes, for some of the training (0.25)
  • Yes, for at least half of the training (0.5)
  • Yes, for most or all of the training (1)
G-EG-3-A Have you implemented a Learning Management System or equivalent to track employee training and certification processes?

Question: Have you implemented a Learning Management System or equivalent to track employee training and certification processes?

Quality criteria

  • A Learning Management System (LMS) is used to track trainings and certifications
  • Training is based on internal standards, policies, and procedures
  • You use certification programs or attendance records to determine access to development systems and resources

Answers

  • No (0)
  • Yes, for some of the training (0.25)
  • Yes, for at least half of the training (0.5)
  • Yes, for most or all of the training (1)
G-EG-1-B Have you identified a Security Champion for each development team?

Question: Have you identified a Security Champion for each development team?

Quality criteria

  • Security Champions receive appropriate training
  • Application Security and Development teams receive periodic briefings from Security Champions on the overall status of security initiatives and fixes
  • The Security Champion reviews the results of external testing before adding to the application backlog

Answers

  • No (0)
  • Yes, for some teams (0.25)
  • Yes, for at least half of the teams (0.5)
  • Yes, for most or all of the teams (1)
G-EG-2-B Does the organization have a Secure Software Center of Excellence (SSCE)?

Question: Does the organization have a Secure Software Center of Excellence (SSCE)?

Quality criteria

  • The SSCE has a charter defining its role in the organization
  • Development teams review all significant architectural changes with the SSCE
  • The SSCE publishes SDLC standards and guidelines related to Application Security
  • Product Champions are responsible for promoting the use of specific security tools

Answers

  • No (0)
  • Yes, we started implementing it (0.25)
  • Yes, for part of the organization (0.5)
  • Yes, for the entire organization (1)
G-EG-3-B Is there a centralized portal where developers and application security professionals from different teams and business units are able to communicate and share information?

Question: Is there a centralized portal where developers and application security professionals from different teams and business units are able to communicate and share information?

Quality criteria

  • The organization promotes use of a single portal across different teams and business units
  • The portal is used for timely information such as notification of security incidents, tool updates, architectural standard changes, and other related announcements
  • The portal is widely recognized by developers and architects as a centralized repository of the organization-specific application security information
  • All content is considered persistent and searchable
  • The portal provides access to application-specific security metrics

Answers

  • No (0)
  • Yes, we started implementing it (0.25)
  • Yes, for part of the organization (0.5)
  • Yes, for the entire organization (1)
D-TA-1-A Do you classify applications according to business risk based on a simple and predefined set of questions?

Question: Do you classify applications according to business risk based on a simple and predefined set of questions?

Quality criteria

  • An agreed-upon risk classification exists
  • The application team understands the risk classification
  • The risk classification covers critical aspects of business risks the organization is facing
  • The organization has an inventory for the applications in scope

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
D-TA-2-A Do you use centralized and quantified application risk profiles to evaluate business risk?

Question: Do you use centralized and quantified application risk profiles to evaluate business risk?

Quality criteria

  • The application risk profile is in line with the organizational risk standard
  • The application risk profile covers impact to security and privacy
  • You validate the quality of the risk profile manually and/or automatically
  • The application risk profiles are stored in a central inventory

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-TA-3-A Do you regularly review and update the risk profiles for your applications?

Question: Do you regularly review and update the risk profiles for your applications?

Quality criteria

  • The organizational risk standard considers historical feedback to improve the evaluation method
  • Significant changes in the application or business context trigger a review of the relevant risk profiles

Answers

  • No (0)
  • Yes, but we do it ad-hoc (0.25)
  • Yes, we do it regularly (0.5)
  • Yes, we do it continuously (1)
D-TA-1-B Do you identify and manage architectural design flaws with threat modeling?

Question: Do you identify and manage architectural design flaws with threat modeling?

Quality criteria

  • You perform threat modeling for high-risk applications
  • You use simple threat checklists, such as STRIDE
  • You persist the outcome of a threat model for later use

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
D-TA-2-B Do you use a standard methodology, aligned with your application risk levels?

Question: Do you use a standard methodology, aligned with your application risk levels?

Quality criteria

  • You train your architects, security champions, and other stakeholders on how to do practical threat modeling
  • Your threat modeling methodology includes at least diagramming, threat identification, design flaw mitigations, and how to validate your threat model artifacts
  • Changes in the application or business context trigger a review of the relevant threat models
  • You capture the threat modeling artifacts with tools used by your application teams

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-TA-3-B Do you regularly review and update the threat modeling methodology for your applications?

Question: Do you regularly review and update the threat modeling methodology for your applications?

Quality criteria

  • The threat modeling methodology considers historical feedback for improvement
  • You regularly (e.g., yearly) review the existing threat models to verify that no new threats are relevant for your applications
  • You automate parts of your threat modeling process with threat modeling tools

Answers

  • No (0)
  • Yes, but review is ad-hoc (0.25)
  • Yes, we review it regularly (0.5)
  • Yes, we review it continuously (1)
D-SR-1-A Do project teams specify security requirements during development?

Question: Do project teams specify security requirements during development?

Quality criteria

  • Teams derive security requirements from functional requirements and customer or organization concerns
  • Security requirements are specific, measurable, and reasonable
  • Security requirements are in line with the organizational baseline

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-SR-2-A Do you define, structure, and include prioritization in the artifacts of the security requirements gathering process?

Question: Do you define, structure, and include prioritization in the artifacts of the security requirements gathering process?

Quality criteria

  • Security requirements take into consideration domain-specific knowledge when applying policies and guidance to product development
  • Domain experts are involved in the requirements definition process
  • You have an agreed-upon structured notation for security requirements
  • Development teams have a security champion dedicated to reviewing security requirements and outcomes

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
D-SR-3-A Do you use a standard requirements framework to streamline the elicitation of security requirements?

Question: Do you use a standard requirements framework to streamline the elicitation of security requirements?

Quality criteria

  • A security requirements framework is available for project teams
  • The framework is categorized by common requirements and standards-based requirements
  • The framework gives clear guidance on the quality of requirements and how to describe them
  • The framework is adaptable to specific business requirements

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-SR-1-B Do stakeholders review vendor collaborations for security requirements and methodology?

Question: Do stakeholders review vendor collaborations for security requirements and methodology?

Quality criteria

  • You consider including specific security requirements, activities, and processes when creating third-party agreements
  • A vendor questionnaire is available and used to assess the strengths and weaknesses of your suppliers

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
D-SR-2-B Do vendors meet the security responsibilities and quality measures of service level agreements defined by the organization?

Question: Do vendors meet the security responsibilities and quality measures of service level agreements defined by the organization?

Quality criteria

  • You discuss security requirements with the vendor when creating vendor agreements
  • Vendor agreements provide specific guidance on security defect remediation within an agreed-upon timeframe
  • The organization has a templated agreement of responsibilities and service levels for key vendor security processes
  • You measure key performance indicators

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
D-SR-3-B Are vendors aligned with standard security controls and software development tools and processes that the organization utilizes?

Question: Are vendors aligned with standard security controls and software development tools and processes that the organization utilizes?

Quality criteria

  • The vendor has a secure SDLC that includes secure build, secure deployment, defect management, and incident management, meets the security expectations of your organization, and is able to demonstrate operating effectiveness of practices.
  • You verify the solution meets quality and security objectives before every major release
  • When standard verification processes are not available, you use compensating controls such as software composition analysis and independent penetration testing

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
D-SA-1-A Do teams use security principles during design?

Question: Do teams use security principles during design?

Quality criteria

  • You have an agreed upon checklist of security principles
  • You store your checklist in an accessible location
  • Relevant stakeholders understand security principles

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-SA-2-A Do you use shared security services during design?

Question: Do you use shared security services during design?

Quality criteria

  • You have a documented list of reusable security services, available to relevant stakeholders
  • You have reviewed the baseline security posture for each selected service
  • Your designers are trained to integrate each selected service following available guidance

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-SA-3-A Do you base your design on available reference architectures?

Question: Do you base your design on available reference architectures?

Quality criteria

  • You have one or more approved reference architectures documented and available to stakeholders
  • You improve the reference architectures continuously based on insights and best practices
  • You provide a set of components, libraries, and tools to implement each reference architecture

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-SA-1-B Do you evaluate the security quality of important technologies used for development?

Question: Do you evaluate the security quality of important technologies used for development?

Quality criteria

  • You have a list of the most important technologies used in, or in support of, each application
  • You identify and track technological risks
  • You ensure the risks to these technologies are in line with the organizational baseline

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
D-SA-2-B Do you have a list of recommended technologies for the organization?

Question: Do you have a list of recommended technologies for the organization?

Quality criteria

  • The list is based on technologies used in the software portfolio
  • Lead architects and developers review and approve the list
  • You share the list across the organization
  • You review and update the list at least yearly

Answers

  • No (0)
  • Yes, for some of the technology domains (0.25)
  • Yes, for at least half of the technology domains (0.5)
  • Yes, for most or all of the technology domains (1)
D-SA-3-B Do you enforce the use of recommended technologies within the organization?

Question: Do you enforce the use of recommended technologies within the organization?

Quality criteria

  • You monitor applications regularly for the correct use of the recommended technologies
  • You solve violations against the list according to organizational policies
  • You take action if the number of violations falls outside the yearly objectives

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SB-1-A Is your full build process formally described?

Question: Is your full build process formally described?

Quality criteria

  • You have enough information to recreate the build processes
  • Your build documentation is up to date
  • Your build documentation is stored in an accessible location
  • Produced artifact checksums are created during build to support later verification
  • You harden the tools that are used within the build process

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SB-2-A Is the build process fully automated?

Question: Is the build process fully automated?

Quality criteria

  • The build process itself doesn't require any human interaction
  • Your build tools are hardened as per best practice and vendor guidance
  • You encrypt the secrets required by the build tools and control access based on the principle of least privilege

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SB-3-A Do you enforce automated security checks in your build processes?

Question: Do you enforce automated security checks in your build processes?

Quality criteria

  • Builds fail if the application doesn't meet a predefined security baseline
  • You have a maximum accepted severity for vulnerabilities
  • You log warnings and failures in a centralized system
  • You select and configure tools to evaluate each application against its security requirements at least once a year

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SB-1-B Do you have solid knowledge of the dependencies you rely on?

Question: Do you have solid knowledge of the dependencies you rely on?

Quality criteria

  • You have a current bill of materials (BOM) for every application
  • You can quickly find out which applications are affected by a particular CVE
  • You have analyzed, addressed, and documented findings from dependencies at least once in the last three months

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SB-2-B Do you handle third-party dependency risk through a formal process?

Question: Do you handle third-party dependency risk through a formal process?

Quality criteria

  • You keep a list of approved dependencies that meet predefined criteria
  • You automatically evaluate dependencies for new CVEs and alert responsible staff
  • You automatically detect and alert to license changes with possible impact on legal application usage
  • You track and alert to usage of unmaintained dependencies
  • You reliably detect and remove unnecessary dependencies from the software

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SB-3-B Do you prevent the build of software if it is affected by vulnerabilities in dependencies?

Question: Do you prevent the build of software if it is affected by vulnerabilities in dependencies?

Quality criteria

  • Your build system is connected to a system for tracking 3rd party dependency risk, causing build to fail unless the vulnerability is evaluated to be a false positive or the risk is explicitly accepted
  • You scan your dependencies using a static analysis tool
  • You report findings back to dependency authors using an established responsible disclosure process
  • Using a new dependency not evaluated for security risks causes the build to fail

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SD-1-A Do you use repeatable deployment processes?

Question: Do you use repeatable deployment processes?

Quality criteria

  • You have enough information to run the deployment processes
  • Your deployment documentation is up to date
  • Your deployment documentation is accessible to relevant stakeholders
  • You ensure that only defined qualified personnel can trigger a deployment
  • You harden the tools that are used within the deployment process

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SD-2-A Are deployment processes automated and employing security checks?

Question: Are deployment processes automated and employing security checks?

Quality criteria

  • Deployment processes are automated on all stages
  • Deployment includes automated security testing procedures
  • You alert responsible staff to identified vulnerabilities
  • You have logs available for your past deployments for a defined period of time

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SD-3-A Do you consistently validate the integrity of deployed artifacts?

Question: Do you consistently validate the integrity of deployed artifacts?

Quality criteria

  • You prevent or roll back deployment if you detect an integrity breach
  • The verification is done against signatures created during the build time
  • If checking of signatures is not possible (e.g. externally built software), you introduce compensating measures

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SD-1-B Do you limit access to application secrets according to the least privilege principle?

Question: Do you limit access to application secrets according to the least privilege principle?

Quality criteria

  • You store production secrets protected in a secured location
  • Developers do not have access to production secrets
  • Production secrets are not available in non-production environments

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SD-2-B Do you inject production secrets into configuration files during deployment?

Question: Do you inject production secrets into configuration files during deployment?

Quality criteria

  • Source code files no longer contain active application secrets
  • Under normal circumstances, no humans access secrets during deployment procedures
  • You log and alert when abnormal secrets access is attempted

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-SD-3-B Do you practice proper lifecycle management for application secrets?

Question: Do you practice proper lifecycle management for application secrets?

Quality criteria

  • You generate and synchronize secrets using a vetted solution
  • Secrets are different between different application instances
  • Secrets are regularly updated

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-DM-1-A Do you track all known security defects in accessible locations?

Question: Do you track all known security defects in accessible locations?

Quality criteria

  • You can easily get an overview of all security defects impacting one application
  • You have at least a rudimentary classification scheme in place
  • The process includes a strategy for handling false positives and duplicate entries
  • The defect management system covers defects from various sources and activities

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-DM-2-A Do you keep an overview of the state of security defects across the organization?

Question: Do you keep an overview of the state of security defects across the organization?

Quality criteria

  • A single severity scheme is applied to all defects across the organization
  • The scheme includes SLAs for fixing particular severity classes
  • You regularly report compliance to SLAs

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-DM-3-A Do you enforce SLAs for fixing security defects?

Question: Do you enforce SLAs for fixing security defects?

Quality criteria

  • You automatically generate alerts for SLA breaches and transfer respective defects to the risk management process
  • You integrate relevant tooling (e.g. monitoring, build, deployment) with the defect management system

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-DM-1-B Do you use basic metrics about recorded security defects to carry out quick-win improvement activities?

Question: Do you use basic metrics about recorded security defects to carry out quick-win improvement activities?

Quality criteria

  • You have analyzed your recorded metrics at least once in the last year
  • At least basic information about this initiative is recorded and available
  • You have identified and carried out at least one quick-win activity based on the data

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-DM-2-B Do you improve your security assurance program upon standardized metrics?

Question: Do you improve your security assurance program upon standardized metrics?

Quality criteria

  • You document metrics for defect classification and categorization and keep them up to date
  • Executive management regularly receives information about defects and has acted upon it in the last year
  • You regularly share technical details about security defects among teams

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
I-DM-3-B Do you regularly evaluate the effectiveness of your security metrics so that their input helps drive your security strategy?

Question: Do you regularly evaluate the effectiveness of your security metrics so that their input helps drive your security strategy?

Quality criteria

  • You have analyzed the effectiveness of the security metrics at least once in the last year
  • Where possible, you verify the correctness of the data automatically
  • The metrics are aggregated with other sources like threat intelligence or incident management
  • You derived at least one strategic activity from the metrics in the last year

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-AA-1-A Do you review the application architecture for key security objectives on an ad-hoc basis?

Question: Do you review the application architecture for key security objectives on an ad-hoc basis?

Quality criteria

  • You have an agreed upon model of the overall software architecture
  • You include components, interfaces, and integrations in the architecture model
  • You verify the correct provision of general security mechanisms
  • You log missing security controls as defects

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-AA-2-A Do you regularly review the security mechanisms of your architecture?

Question: Do you regularly review the security mechanisms of your architecture?

Quality criteria

  • You review compliance with internal and external requirements
  • You systematically review each interface in the system
  • You use a formalized review method and structured validation
  • You log missing security mechanisms as defects

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-AA-3-A Do you regularly review the effectiveness of the security controls?

Question: Do you regularly review the effectiveness of the security controls?

Quality criteria

  • You evaluate the preventive, detective, and response capabilities of security controls
  • You evaluate the strategy alignment, appropriate support, and scalability of security controls
  • You evaluate the effectiveness at least yearly
  • You log identified shortcomings as defects

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-AA-1-B Do you review the application architecture for mitigations of typical threats on an ad-hoc basis?

Question: Do you review the application architecture for mitigations of typical threats on an ad-hoc basis?

Quality criteria

  • You have an agreed upon model of the overall software architecture
  • Security savvy staff conduct the review
  • You consider different types of threats, including insider and data-related ones

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-AA-2-B Do you regularly evaluate the threats to your architecture?

Question: Do you regularly evaluate the threats to your architecture?

Quality criteria

  • You systematically review each threat identified in the Threat Assessment
  • Trained or experienced people lead the review exercise
  • You identify mitigating design-level features for each identified threat
  • You log unhandled threats as defects

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-AA-3-B Do you regularly update your reference architectures based on architecture assessment findings?

Question: Do you regularly update your reference architectures based on architecture assessment findings?

Quality criteria

  • You assess your architectures in a standardized, documented manner
  • You use recurring findings to trigger a review of reference architectures
  • You independently review the quality of the architecture assessments on an ad-hoc basis
  • You use reference architecture updates to trigger reviews of relevant shared solutions, in a risk-based manner

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-RT-1-A Do you test applications for the correct functioning of standard security controls?

Question: Do you test applications for the correct functioning of standard security controls?

Quality criteria

  • Security testing at least verifies the implementation of authentication, access control, input validation, encoding and escaping data, and encryption controls
  • Security testing executes whenever the application changes its use of the controls

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
V-RT-2-A Do you consistently write and execute test scripts to verify the functionality of security requirements?

Question: Do you consistently write and execute test scripts to verify the functionality of security requirements?

Quality criteria

  • You tailor tests to each application and assert expected security functionality
  • You capture test results as a pass or fail condition
  • Tests use a standardized framework or DSL

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
V-RT-3-A Do you automatically test applications for security regressions?

Question: Do you automatically test applications for security regressions?

Quality criteria

  • You consistently write tests for all identified bugs (possibly exceeding a pre-defined severity threshold)
  • You collect security tests in a test suite that is part of the existing unit testing framework

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-RT-1-B Do you test applications using randomization or fuzzing techniques?

Question: Do you test applications using randomization or fuzzing techniques?

Quality criteria

  • Testing covers most or all of the application's main input parameters
  • You record and inspect all application crashes for security impact on a best-effort basis

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-RT-2-B Do you create abuse cases from functional requirements and use them to drive security tests?

Question: Do you create abuse cases from functional requirements and use them to drive security tests?

Quality criteria

  • Important business functionality has corresponding abuse cases
  • You build abuse stories around relevant personas with well-defined motivations and characteristics
  • You capture identified weaknesses as security requirements

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
V-RT-3-B Do you perform denial of service and security stress testing?

Question: Do you perform denial of service and security stress testing?

Quality criteria

  • Stress tests target specific application resources (e.g. memory exhaustion by saving large amounts of data to a user session)
  • You design tests around relevant personas with well-defined capabilities (knowledge, resources)
  • You feed the results back to the Design practices

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
V-ST-1-A Do you scan applications with automated security testing tools?

Question: Do you scan applications with automated security testing tools?

Quality criteria

  • You dynamically generate inputs for security tests using automated tools
  • You choose the security testing tools to fit the organization's architecture and technology stack, and balance depth and accuracy of inspection with usability of findings to the organization

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
V-ST-2-A Do you customize the automated security tools to your applications and technology stacks?

Question: Do you customize the automated security tools to your applications and technology stacks?

Quality criteria

  • You tune and select tool features which match your application or technology stack
  • You minimize false positives by silencing or automatically filtering irrelevant warnings or low-probability findings
  • You minimize false negatives by leveraging tool extensions or DSLs to customize tools for your application or organizational standards

Answers

  • No (0)
  • Yes, some of them (0.25)
  • Yes, at least half of them (0.5)
  • Yes, most or all of them (1)
V-ST-3-A Do you integrate automated security testing into the build and deploy process?

Question: Do you integrate automated security testing into the build and deploy process?

Quality criteria

  • Management and business stakeholders track and review test results throughout the development cycle
  • You merge test results into a central dashboard and feed them into defect management

Answers

  • No (0)
  • Yes, some of it (0.25)
  • Yes, at least half of it (0.5)
  • Yes, most or all of it (1)
V-ST-1-B Do you manually review the security quality of selected high-risk components?

Question: Do you manually review the security quality of selected high-risk components?

Quality criteria

  • Criteria exist to help the reviewer focus on high-risk components
  • Qualified personnel conduct reviews following documented guidelines
  • You address findings in accordance with the organization's defect management policy

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
V-ST-2-B Do you perform penetration testing for your applications at regular intervals?

Question: Do you perform penetration testing for your applications at regular intervals?

Quality criteria

  • Penetration testing uses application-specific security test cases to evaluate security
  • Penetration testing looks for both technical and logical issues in the application
  • Stakeholders review the test results and handle them in accordance with the organization's risk management
  • Qualified personnel perform penetration testing

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
V-ST-3-B Do you use the results of security testing to improve the development lifecycle?

Question: Do you use the results of security testing to improve the development lifecycle?

Quality criteria

  • You use results from other security activities to improve integrated security testing during development
  • You review test results and incorporate them into security awareness training and security testing playbooks
  • Stakeholders review the test results and handle them in accordance with the organization's risk management

Answers

  • No (0)
  • Yes, but we improve it ad-hoc (0.25)
  • Yes, we improve it regularly (0.5)
  • Yes, we improve it continuously (1)
O-IM-1-A Do you analyze log data for security incidents periodically?

Question: Do you analyze log data for security incidents periodically?

Quality criteria

  • You have a contact point for the creation of security incidents
  • You analyze data in accordance with the log data retention periods
  • The frequency of this analysis is aligned with the criticality of your applications

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
O-IM-2-A Do you follow a documented process for incident detection?

Question: Do you follow a documented process for incident detection?

Quality criteria

  • The process has a dedicated owner
  • You store process documentation in an accessible location
  • The process considers an escalation path for further analysis
  • You train employees responsible for incident detection in this process
  • You have a checklist of potential attacks to simplify incident detection

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
O-IM-3-A Do you review and update the incident detection process regularly?

Question: Do you review and update the incident detection process regularly?

Quality criteria

  • You perform reviews at least annually
  • You update the checklist of potential attacks with external and internal data

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
O-IM-1-B Do you respond to detected incidents?

Question: Do you respond to detected incidents?

Quality criteria

  • You have a defined person or role for incident handling
  • You document security incidents

Answers

  • No (0)
  • Yes, for some incidents (0.25)
  • Yes, for at least half of the incidents (0.5)
  • Yes, for most or all of the incidents (1)
O-IM-2-B Do you use a repeatable process for incident handling?

Question: Do you use a repeatable process for incident handling?

Quality criteria

  • You have an agreed upon incident classification
  • The process considers Root Cause Analysis for high severity incidents
  • Employees responsible for incident response are trained in this process
  • Forensic analysis tooling is available

Answers

  • No (0)
  • Yes, for some incident types (0.25)
  • Yes, for at least half of the incident types (0.5)
  • Yes, for most or all of the incident types (1)
O-IM-3-B Do you have a dedicated incident response team available?

Question: Do you have a dedicated incident response team available?

Quality criteria

  • The team performs Root Cause Analysis for all security incidents unless there is a specific reason not to do so
  • You review and update the response process at least annually

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
O-EM-1-A Do you harden configurations for key components of your technology stacks?

Question: Do you harden configurations for key components of your technology stacks?

Quality criteria

  • You have identified the key components in each technology stack used
  • You have an established configuration standard for each key component

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
O-EM-2-A Do you have hardening baselines for your components?

Question: Do you have hardening baselines for your components?

Quality criteria

  • You have assigned an owner for each baseline
  • The owner keeps their assigned baselines up to date
  • You store baselines in an accessible location
  • You train employees responsible for configurations in these baselines

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
O-EM-3-A Do you monitor and enforce conformity with hardening baselines?

Question: Do you monitor and enforce conformity with hardening baselines?

Quality criteria

  • You perform conformity checks regularly, preferably using automation
  • You store conformity check results in an accessible location
  • You follow an established process to address reported non-conformities
  • You review each baseline at least annually, and update it when required

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
O-EM-1-B Do you identify and patch vulnerable components?

Question: Do you identify and patch vulnerable components?

Quality criteria

  • You have an up-to-date list of components, including version information
  • You regularly review public sources for vulnerabilities related to your components

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
O-EM-2-B Do you follow an established process for updating components of your technology stacks?

Question: Do you follow an established process for updating components of your technology stacks?

Quality criteria

  • The process includes vendor information for third-party patches
  • The process considers external sources to gather information about zero day attacks, and includes appropriate risk mitigation steps
  • The process includes guidance for prioritizing component updates

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
O-EM-3-B Do you regularly evaluate components and review patch level status?

Question: Do you regularly evaluate components and review patch level status?

Quality criteria

  • You update the list with components and versions
  • You identify and apply missing updates according to the existing SLA
  • You review and update the process based on feedback from the people who perform patching

Answers

  • No (0)
  • Yes, for some components (0.25)
  • Yes, for at least half of the components (0.5)
  • Yes, for most or all of the components (1)
O-OM-1-A Do you protect and handle information according to protection requirements for data stored and processed on each application?

Question: Do you protect and handle information according to protection requirements for data stored and processed on each application?

Quality criteria

  • You know the data elements processed and stored by each application
  • You know the type and sensitivity level of each identified data element
  • You have controls to prevent propagation of unsanitized sensitive data from production to lower environments

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
O-OM-2-A Do you maintain a data catalog, including types, sensitivity levels, and processing and storage locations?

Question: Do you maintain a data catalog, including types, sensitivity levels, and processing and storage locations?

Quality criteria

  • The data catalog is stored in an accessible location
  • You know which data elements are subject to specific regulation
  • You have controls for protecting and preserving data throughout its lifetime
  • You have retention requirements for data, and you destroy backups in a timely manner after the relevant retention period ends

Answers

  • No (0)
  • Yes, for some of our data (0.25)
  • Yes, for at least half of our data (0.5)
  • Yes, for most or all of our data (1)
O-OM-3-A Do you regularly review and update the data catalog and your data protection policies and procedures?

Question: Do you regularly review and update the data catalog and your data protection policies and procedures?

Quality criteria

  • You have automated monitoring to detect attempted or actual violations of the Data Protection Policy
  • You have tools for data loss prevention, access control and tracking, or anomalous behavior detection
  • You periodically audit the operation of automated mechanisms, including backups and record deletions

Answers

  • No (0)
  • Yes, but we do it ad-hoc (0.25)
  • Yes, we do it regularly (0.5)
  • Yes, we do it continuously (1)
O-OM-1-B Do you identify and remove systems, applications, application dependencies, or services that are no longer used, have reached end of life, or are no longer actively developed or supported?

Question: Do you identify and remove systems, applications, application dependencies, or services that are no longer used, have reached end of life, or are no longer actively developed or supported?

Quality criteria

  • You do not use unsupported applications or dependencies
  • You manage customer/user migration from older versions for each product and customer/user group

Answers

  • No (0)
  • Yes, for some applications (0.25)
  • Yes, for at least half of the applications (0.5)
  • Yes, for most or all of the applications (1)
O-OM-2-B Do you follow an established process for removing all associated resources, as part of decommissioning of unused systems, applications, application dependencies, or services?

Question: Do you follow an established process for removing all associated resources, as part of decommissioning of unused systems, applications, application dependencies, or services?

Quality criteria

  • You document the status of support for all released versions of your products, in an accessible location
  • The process includes replacement or upgrade of third-party applications, or application dependencies, that have reached end of life
  • Operating environments do not contain orphaned accounts, firewall rules, or other configuration artifacts

Answers

  • No (0)
  • Yes, some of the time (0.25)
  • Yes, at least half of the time (0.5)
  • Yes, most or all of the time (1)
O-OM-3-B Do you regularly evaluate the lifecycle state and support status of every software asset and underlying infrastructure component, and estimate their end of life?

Question: Do you regularly evaluate the lifecycle state and support status of every software asset and underlying infrastructure component, and estimate their end of life?

Quality criteria

  • Your end of life management process is agreed upon
  • You inform customers and user groups of product timelines to prevent disruption of service or support
  • You review the process at least annually

Answers

  • No (0)
  • Yes, for some of the assets (0.25)
  • Yes, for at least half of the assets (0.5)
  • Yes, for most or all of the assets (1)