Goals
How important is it for your organization to compare against peers?
This question got a 7 or higher reply from 69% of SAMM users during our 2022 questionnaire. Helping our users answer the critical questions “How am I doing?” and “What might be working for other similar organizations?” has been part of our roadmap for quite some time. Now, we’ve made it a priority. It is our goal to build a database for companies to measure the maturity of their security development practices against the industry based on variables such as verticals and company size. In turn, the information we collect can help the SAMM model evolve based on actual information from the field. As an added benefit, this project can facilitate research on secure development practices worldwide as universities and researchers analyze and interpret the information the community donates, providing valuable insights.
Roles
This initiative can only succeed with the help of the community of SAMM users and practitioners that surround the OWASP SAMM project.
SAMM users and Practitioners help organizations with SAMM assessments and serve as their benchmark data owner. They might be internal to the organization that is submitting data, or external consultants, performing SAMM assessment organizations according to the guidelines you can find in our Getting started page, Determining Scope blog post, and Fundamentals Course .
Submission process
There are 2 ways of submitting data
Uploading it to the Benchmark folder
Please, refer to this video for instructions.Sending it by email to benchmark@owaspsamm.org
The data is collected in an anonymous way and covered by the following terms and conditions. During the submission process we will ask for some metadata. The more information provided, the better the comparative analysis will be.
To help practitioners get permission from their clients or companies to submit datasets, we have created the following email template .
Tapping into the benchmark data
The end-goal of the benchmark initiative is for companies to use the data to measure themselves against their peers in the industry. Our main hurdle at this point is to gather a large enough dataset to guarantee accurate comparisons and maintain full anonymity for the contributing parties.
As an added benefit, we’ll use the data to prioritize the publication of guidance for streams and activities.
Updates
We will be updating this page and the process as the project progresses. If you have any questions, please send an email to benchmark@owaspsamm.org