OWASP BSIMM

Overview

BSIMM (Building Security In Maturity Model) is a data-driven study of real-world software security initiatives, maintained in collaboration with the OWASP community. Unlike prescriptive models, BSIMM is descriptive: it measures what organizations actually do and provides benchmarking against the observed practices of 100+ leading organizations across finance, technology, healthcare, and government. CodeMiners' alignment with BSIMM demonstrates that our security practices are benchmarked against industry peers.

Governing Body

Synopsys / OWASP Foundation

Scope of Certification

Covers 12 practices across four domains: Governance (strategy and metrics, compliance and policy, training), Intelligence (attack models, security features and design, standards and requirements), SSDL Touchpoints (architecture analysis, code review, security testing), and Deployment (penetration testing, software environment, configuration management and vulnerability management).

Audit and Assessment Process

A BSIMM assessment involves structured interviews with software security group members, development leads, and operations staff. Activities are scored against the BSIMM framework and compared to the community dataset. The resulting scorecard shows relative strengths and gaps.

Key Requirements

1. Defined software security group (SSG) or function
2. Security training program for developers
3. Threat modeling or architecture risk analysis
4. Static and dynamic security testing in the SDLC
5. Penetration testing program
6. Software composition analysis for third-party components

Compliance Entitlements

• Benchmarked against 100+ real-world security programs
• Data-driven, descriptive measurement of actual practices
• Identifies maturity gaps relative to industry peers
• Complements OWASP SAMM with empirical benchmarking

Client Benefits

• Demonstrates that CodeMiners' security practices are measured against real industry data
• Provides evidence-based assurance rather than compliance-checkbox security
• Identifies how CodeMiners compares to peer organizations in the same sector

Related Certifications