--- key: "choosing-bsimm-samm-ssdf" title: "BSIMM vs SAMM vs SSDF: what each is for and which to use" url: "https://softwaresecurity.com/frameworks/bsimm-samm-ssdf/" api: "https://softwaresecurity.com/api/v1/articles/choosing-bsimm-samm-ssdf.json" domain: "governance" topic: "Governance \u0026 frameworks" type: "Guide" identifiers: [] tags: ["AppSec programs","Secure development lifecycle"] stages: ["govern"] roles: ["appsec-engineer","security-leader"] license: "CC-BY-4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" code_license: "MIT" --- # BSIMM vs SAMM vs SSDF: what each is for and which to use How BSIMM16, OWASP SAMM 2.2.0 and NIST SSDF 1.1 differ, what each measures and does not, a chooser by situation, and a verified SSDF-to-BSIMM16-and-SAMM crosswalk with a script that reports evidence gaps. Canonical URL: https://softwaresecurity.com/frameworks/bsimm-samm-ssdf/ ## In short Use them for different jobs. NIST SSDF lists the secure development outcomes to show evidence for, and is what customers and US agencies ask about. OWASP SAMM is a free, prescriptive maturity model for planning what to improve next and measuring your own progress. BSIMM describes what a pool of real organizations actually do (111 firms in BSIMM16), so it answers "how do we compare with peers?". Most programs use SSDF as the outcome list, SAMM for the roadmap, and BSIMM only when they need an external benchmark. - Do use SSDF 1.1 as the list of outcomes you must evidence; 1.2 was still a draft on 11 October 2026, and since OMB M-26-05 (23 January 2026) the federal attestation form is no longer required government-wide, though an agency may still choose to use it. - Do use SAMM 2.2.0 to score your own practices and pick the next activities, scoped to a defined set of teams or applications. - Do use BSIMM16 when you need to compare with peers; it describes what others do, not what you should do. - Don't compare a SAMM score with a BSIMM scorecard: they measure different things on different scales. - Don't trust old activity IDs: SSDF 1.1 cites BSIMM12 numbers, and BSIMM renumbers activities between editions. ## Recommended defaults | Setting | Value | Note | Source | | --- | --- | --- | --- | | BSIMM edition | BSIMM16, January 2026 | 111 firms, 128 activities in 12 practices and 4 domains (Governance, Intelligence, SSDL Touchpoints, Deployment). | BSIMM16 report | | OWASP SAMM version | 2.2.0 | Released in the owaspsamm/core repository on 6 July 2026; previous release 2.1.0 (September 2024). | OWASP SAMM | | SAMM structure | 5 business functions, 15 practices, 2 streams per practice, 3 maturity levels | — | OWASP SAMM model | | NIST SSDF | SP 800-218 version 1.1, final since 3 February 2022 | SP 800-218 Rev. 1 (SSDF 1.2) initial public draft 17 December 2025; still a draft on 10 October 2026. | NIST CSRC | | US federal attestation | Optional for agencies since OMB M-26-05 (23 January 2026) | M-26-05 rescinded M-22-18 and M-23-16; agencies may still ask for an attestation or SBOM based on risk. | OMB M-26-05 | ## Verify it 1. Write down which question each model answers in your program (outcomes, roadmap, benchmark); if two models answer the same question, drop one. 2. Check that every SAMM score names its scope (teams or applications) and date, and compare scores only across the same scope. 3. Run the gap script over your SSDF evidence file and confirm every task either has evidence or an owner and date. 4. Before quoting a BSIMM activity ID from SSDF or an older report, look it up in BSIMM16; several have moved. ## What you will learn - Explain what BSIMM, SAMM and SSDF each measure and what they cannot tell you. - Choose a model, or a combination, for a given situation and stakeholder. - Build a crosswalk from the references NIST already publishes and keep BSIMM IDs current. - Report evidence gaps per SSDF task with a repeatable script. Audience: AppSec leads, product security managers and engineering leaders choosing how to structure, assess or report a security program Before you start: - Know the scope of your security program: teams, products and customers. - Have read, or be ready to read, one of the three models' primary documents. - For the script: Python 3.11 or later. Time: About 29 minutes: 8 to read and 21 for the exercise ## What are BSIMM, SAMM and SSDF? BSIMM, the Building Security In Maturity Model, is a descriptive model. Each year its authors assess the software security initiatives of participating firms and publish which activities they observed and how often. BSIMM16, published in January 2026 by Black Duck, covers 111 firms and 128 activities, organized into 12 practices in four domains: Governance, Intelligence, SSDL Touchpoints and Deployment. Activities sit at three levels by how commonly they are observed. The report says plainly that it observes and quantifies what organizations do rather than prescribing activities. A BSIMM assessment by its consultants produces a scorecard that compares a firm with the data pool; the report also explains how to build your own scorecard from the activity descriptions. OWASP SAMM, the Software Assurance Maturity Model, is prescriptive and open. Version 2.2.0 of the core model was released on 6 July 2026. It has five business functions (Governance, Design, Implementation, Verification, Operations), each with three practices; every practice has two streams and three maturity levels. Assessors answer one question per activity on a four-step scale (no; yes for some; yes for at least half; yes for most or all), scored 0, 0.25, 0.5 and 1, with wording that depends on the activity (applications, teams, components or training). The free toolbox turns the answers into maturity scores of 0 to 3 per practice. See /frameworks/samm-assessment/ for running an assessment. NIST SSDF, the Secure Software Development Framework in SP 800-218, is a list of practices and tasks in four groups: Prepare the Organization (PO), Protect the Software (PS), Produce Well-Secured Software (PW) and Respond to Vulnerabilities (RV). It states outcomes, not how to reach them, and cites other frameworks, including BSIMM and SAMM, as informative references. Version 1.1 has been final since February 2022; the 1.2 draft adds tasks but was still a draft in October 2026. See /frameworks/ssdf-product-lifecycle/. ## BSIMM vs SAMM vs SSDF: how do they differ? | Question | BSIMM16 | OWASP SAMM 2.2.0 | NIST SSDF 1.1 | | --- | --- | --- | --- | | What kind of model? | Descriptive: what participating firms do | Prescriptive maturity model | Outcome list: practices and tasks | | Who maintains it? | Black Duck | OWASP (open community) | NIST | | Unit of measure | Activities observed, compared with the data pool | Maturity score per practice and stream (0 to 3) | Whether each task is done, with evidence | | How you get a result | Assessment by BSIMM consultants, or an informal self-built scorecard | Self-assessment with the free toolbox, or an external assessor | Self-assessment against tasks; customer or agency questionnaires | | Update cycle | Annual edition; activity IDs can change | Occasional releases (2.1.0 in 2024, 2.2.0 in 2026) | Rare; 1.1 in 2022, 1.2 in draft | | Best for | Benchmarking against peers and verticals | Planning the next improvements and measuring progress | A shared vocabulary of outcomes for customers, contracts and audits | | Weak at | Telling you what to do next or why | Comparing with other organizations | Prioritizing or measuring maturity | | Cost to use | Report is free to download; assessments are a commercial service | Free | Free | ## Which one should you use? Pick by the question you need answered, not by popularity. The table gives a starting point for common situations; most mature programs end up using SSDF and SAMM together and adding BSIMM only for benchmarking. | Situation | Start with | Why | | --- | --- | --- | | First AppSec program in a small company | SAMM level-1 activities in a few practices, plus the minimal program at /frameworks/appsec-program/ | Gives a concrete next step per practice without a large assessment | | Selling software to US federal agencies | SSDF 1.1 with evidence per task | Agencies may still ask for an attestation or an SBOM based on risk, and SSDF (SP 800-218) is the first reference OMB M-26-05 points them to | | Manufacturer of products in scope of the EU CRA | CRA Annex I mapped to SSDF tasks; SAMM for the improvement plan | The CRA is the legal baseline; SSDF and SAMM help organize the evidence and the work, but neither is the CRA | | Board asks "how do we compare with peers?" | BSIMM assessment or a self-built BSIMM scorecard | Only BSIMM has a data pool of other organizations | | Leadership wants a maturity trend | SAMM scores on a fixed scope, repeated yearly | Scores are comparable only when scope and assessor method stay the same | | After a major incident or audit finding | The SAMM practice and SSDF tasks for the failed area | Targets the gap; a full assessment can wait | | A customer questionnaire asks about secure development | SSDF task list with links to evidence | Most questionnaires map to SSDF-style outcomes | | Defining what one application must do | Neither: use OWASP ASVS 5.0 | BSIMM, SAMM and SSDF describe programs; ASVS describes application requirements. See /domains/appsec/threat-modeling/security-requirements-definition-of-done/ | ## How do you use them together without triple work? Keep one evidence store and three views of it. SSDF tasks name the outcomes and are what you show customers. SAMM practices organize the improvement roadmap; each SAMM activity you implement should produce evidence that an SSDF task can cite. BSIMM, if you use it, is an annual comparison, not a separate plan. NIST SP 800-218 already lists BSIMM and SAMM activities as informative references for each task, so start your crosswalk from those rather than inventing mappings. Two cautions apply. SSDF 1.1 cites BSIMM12 activity numbers, and the BSIMM16 report lists 16 SSDF tasks whose referenced activities have since moved; for example the training reference for PO.2.2 changed from T3.4 to T2.11. SSDF also cites SAMM by short codes such as EG1-A (Education and Guidance, level 1, stream A), and some codes it uses, such as DR and IR, do not match the practice names of current SAMM releases, so map those by content. ## What does a verified crosswalk look like? The CSV holds only references printed in SP 800-218 version 1.1, for eight tasks that most programs struggle to evidence, with BSIMM numbers updated to BSIMM16 using the report's Table 3. The SAMM column keeps the codes exactly as SSDF cites them. Extend it task by task from the same two sources rather than from memory or vendor mappings. ```csv ssdf_task,summary,bsimm12_as_cited,bsimm16,samm_as_cited PO.1.2,Document security requirements for software the organization develops,SM1.1 SM1.4 SM2.2 CP1.1 CP1.2 CP1.3 CP2.1 CP2.3 AM1.2 SFD1.1 SFD2.1 SFD3.2 SR1.1 SR1.3 SR2.2 SR3.3 SR3.4,SM1.1 SM1.4 SM1.7 CP1.1 CP1.2 CP1.3 CP2.1 CP2.3 AM1.2 SFD1.1 SFD2.1 SFD3.2 SR1.1 SR1.3 SR2.2 SR3.3 SR3.4,PC1-A PC1-B PC2-A PC3-A SR1-A SR1-B SR2-B SA1-B IR1-A PO.2.2,Provide role-based training and review proficiency,T1.1 T1.7 T1.8 T2.5 T2.8 T2.9 T3.1 T3.2 T3.4,T1.1 T1.7 T1.8 T2.5 T2.8 T2.9 T3.1 T3.2 T2.11,EG1-A EG2-A PW.1.1,Use risk modeling such as threat modeling,AM1.2 AM1.3 AM1.5 AM2.1 AM2.2 AM2.5 AM2.6 AM2.7 SFD2.2 AA1.1 AA1.2 AA1.3 AA2.1,AM1.2 AM1.3 AM1.5 AM2.1 AM3.4 AM3.5 AM2.6 AM2.7 SFD2.2 AA1.1 AA1.2 AA2.4 AA2.1,TA1-A TA1-B TA3-B DR1-A PW.1.2,Track security requirements risks and design decisions,SFD3.1 SFD3.3 AA2.2 AA3.2,SFD3.1 SFD3.3 AA2.2 AA3.2,DR1-B RV.1.3,Have a vulnerability disclosure and remediation policy and a PSIRT,CMVM1.1 CMVM2.1 CMVM3.3 CMVM3.7,CMVM1.1 CMVM1.4 CMVM3.3 CMVM2.4,IM1-A IM1-B IM2-A IM2-B RV.2.1,Analyze each vulnerability to plan its remediation,CMVM1.2 CMVM2.2,CMVM1.2 CMVM1.3, RV.2.2,Plan and implement risk responses for vulnerabilities,CMVM2.1,CMVM1.4, RV.3.3,Review software for similar vulnerabilities to remove the class,CR3.3 CMVM3.1,CR3.3 CMVM3.1, ``` ## How do you find SSDF tasks without evidence? Keep a second CSV with one row per task and a pointer to its evidence: a file, a repository, a dashboard or a policy URL. The script lists each task with no evidence and the BSIMM16 activities and SAMM references to read when deciding how to close it. With the sample evidence file it reports four gaps out of eight (PO.2.2 training, PW.1.2 tracking design decisions, RV.2.1 analysis and RV.3.3 class review) and exits with status 1, so it can run in CI on the evidence repository. ```python """Report SSDF tasks without evidence and the BSIMM16 and SAMM activities to read for each. Usage: python ssdf_gaps.py crosswalk.csv evidence.csv The crosswalk holds only references printed in NIST SP 800-218 v1.1, with BSIMM numbers updated to BSIMM16 from the BSIMM16 report's Table 3. """ import csv import sys def load(path, key="ssdf_task"): with open(path, newline="", encoding="utf-8") as f: return {row[key]: row for row in csv.DictReader(f)} def main(crosswalk_path, evidence_path): crosswalk, evidence = load(crosswalk_path), load(evidence_path) gaps = 0 for task, row in crosswalk.items(): found = (evidence.get(task) or {}).get("evidence", "").strip() if found: print(f"OK {task:7} {found}") continue gaps += 1 print(f"GAP {task:7} {row['summary']}") print(f" BSIMM16: {row['bsimm16'] or '-'}") print(f" SAMM (as cited by SSDF 1.1): {row['samm_as_cited'] or '-'}") print(f"{gaps} of {len(crosswalk)} tasks without evidence") return 1 if gaps else 0 if __name__ == "__main__": sys.exit(main(*sys.argv[1:3])) ``` ## Can you compare a SAMM score with a BSIMM scorecard? No. A SAMM score is a weighted answer to "how widely and how well do we do this activity?" for a defined scope, on a 0 to 3 scale per practice. A BSIMM scorecard records which of 128 activities were observed in the whole firm and compares that with the share of firms in the data pool that do each one. A firm can score high in SAMM's Education and Guidance and still lack the specific BSIMM training activities, or the reverse. Report each model on its own terms: SAMM as a trend against your own target, BSIMM as a comparison with peers, SSDF as tasks evidenced or not. If leadership wants one number, choose SAMM on a fixed scope and explain what it leaves out. ## What about other frameworks? - OWASP ASVS 5.0 sets requirements for an application, not a program. Use it inside SSDF PW tasks and SAMM Security Requirements. - CISA Secure by Design is voluntary guidance and a pledge for manufacturers; see /frameworks/secure-by-design/. - ISO/IEC 27001, SOC 2 and PCI DSS are certification or contractual schemes that include secure development controls; map them separately, as in /frameworks/control-mapping-and-evidence/ and /frameworks/pci-dss-requirement-6/. - The EU CRA is law for products in scope; no maturity model satisfies it by itself. See /frameworks/product-security-obligations/. ## Where do framework choices go wrong? - Running a full SAMM or BSIMM assessment before fixing the obvious gaps it will find. - Scoring SAMM across "the whole company" with no defined scope, so next year's score cannot be compared. - Treating BSIMM's most common activities as a mandatory checklist; they describe what is common, not what your risk needs. - Claiming "SSDF compliant" without task-level evidence, or citing the 1.2 draft as if it were final. - Building three separate evidence sets for three models instead of one store with three views. ## Guided practice Rowan, a fictional 400-engineer software company, sells a SaaS product to US federal agencies and an on-premises appliance in the EU. The CISO asks which model to adopt and wants a plan for the next two quarters. ### Supplied material ```text Context (fictional): - Teams: 32 product teams; AppSec team of 4; champions in 9 teams - Customers: two federal agencies have sent questionnaires based on secure development practices; one asks for an SBOM - EU: the appliance is a product with digital elements under the CRA - Board request: "Are we behind our peers?" - Current evidence (from the gap script): 4 of 8 SSDF tasks have evidence; no training records by role; no tracked design decisions - Last year a consultant produced a SAMM score of 1.4 "for the company" with no scope recorded Proposal from an engineering director: "Adopt BSIMM. It is what large companies use." ``` ### 1. Answer the director Is "adopt BSIMM" the right first move? Explain. Worked answer: Not as the first move. BSIMM answers the board's peer question, but it does not produce the task-level evidence federal customers ask for, nor a roadmap. Use SSDF for evidence and SAMM for the plan; consider a BSIMM assessment later for the board. ### 2. Handle the federal questionnaires Which model and which artifacts answer the agencies? Worked answer: SSDF 1.1 with evidence per task, plus an SBOM for the agency that asked. Since OMB M-26-05, agencies decide whether to require an attestation or an SBOM, so answer what each asks; do not cite the 1.2 draft as the baseline. ### 3. Fix the SAMM baseline What is wrong with last year's score of 1.4, and how do you redo it? Worked answer: It has no scope, so it cannot be compared with a new score. Re-run SAMM on a defined scope (for example the 9 champion teams and the appliance team), record the date and method, and set a target per practice. ### 4. Close two evidence gaps Use the crosswalk to plan PO.2.2 and PW.1.2. Worked answer: PO.2.2: role-based training records and a curriculum per role (BSIMM16 T1.1, T2.5, T2.11; SAMM Education and Guidance level 1 and 2 stream A); see /frameworks/developer-security-training/. PW.1.2: track requirements, risks and design decisions in version control (BSIMM16 SFD3.1, AA2.2); see /domains/appsec/threat-modeling/security-requirements-definition-of-done/. ### 5. Place the CRA How does the CRA fit with the models? Worked answer: The CRA is the legal requirement for the appliance; map Annex I and the reporting duties to SSDF tasks to reuse evidence, and use SAMM to plan improvements, but report CRA compliance against the CRA itself. Deliverable: A one-page plan: which model answers which stakeholder, the SAMM scope and date, the SSDF gaps to close this quarter, and when a BSIMM assessment would add value. Scope: Rowan is fictional. The plan assumes the SSDF 1.1 baseline; re-check NIST's status of SSDF 1.2 and any agency-specific requirements before answering a real questionnaire. Articles and teaching material: CC BY 4.0. Original executable code: MIT. Attribution: Software Security. ## Sources - [BSIMM16 report (Black Duck)](https://assets.blackduck.com/image/upload/bsimm-report.pdf). January 2026. - [Black Duck: BSIMM16 report page and FAQ](https://www.blackduck.com/resources/analyst-reports/bsimm.html) - [OWASP SAMM: the model](https://owaspsamm.org/model/) - [OWASP SAMM: assessment toolbox](https://owaspsamm.org/assessment/) - [OWASP SAMM core model release v2.2.0](https://github.com/owaspsamm/core/releases/tag/v2.2.0). 6 July 2026. - [NIST SP 800-218: SSDF version 1.1 (with informative references)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf). Version 1.1 (February 2022). - [NIST SP 800-218 Rev. 1 (SSDF 1.2), initial public draft](https://csrc.nist.gov/pubs/sp/800/218/r1/ipd). SP 800-218 Rev. 1 (initial public draft, December 2025). - [OMB M-26-05: Adopting a Risk-based Approach to Software and Hardware Security (23 January 2026)](https://www.whitehouse.gov/wp-content/uploads/2026/01/M-26-05-Adopting-a-Risk-based-Approach-to-Software-and-Hardware-Security.pdf)