SAMM to Assignments
This mapping connects each SAMM stream to the assignment that leads it and the stakeholders that support it. Use it to identify who in your organization should own and contribute to each security activity.
For each stream, the lead is the role that drives the work. Stakeholders support or collaborate.
Governance
Strategy & Metrics
- Lead: Product Security Strategy
- Stakeholders: Organizational Security Strategy, Business Strategy
Rationale
Product security strategy takes the lead, in close collaboration with organizational security strategy. In smaller organizations, these responsibilities often sit in the same role. The larger executive management team needs to be on board for a security initiative to succeed.- Lead: Product Security Strategy
- Stakeholders: Organizational Security Strategy, Business Strategy
Rationale
Product security strategy and organizational security strategy jointly create the measurement-based improvement approach. Executive management are informed stakeholders.Policy & Compliance
- Lead: Product Security Strategy
- Stakeholders: Organizational Security Strategy, Architecture, Evangelizing Security
Rationale
Policies and standards are defined by product security strategy and signed off by organizational security strategy. Architecture assists in translation to specific product areas, and evangelizing security handles translation to all teams.- Lead: Organizational Security Strategy
- Stakeholders: Cybersecurity Regulatory Compliance, Product Security Strategy, Product Ownership
Rationale
Organizational security strategy leads compliance management, working with cybersecurity regulatory compliance. Product security strategy and product ownership are key stakeholders.Education & Guidance
- Lead: Evangelizing Security
- Stakeholders: Security Awareness and Training
Rationale
Evangelizing security leads the effort on selecting and pushing for secure development and role-specific training, working with security awareness and training to roll it out across the organization.- Lead: Evangelizing Security
- Stakeholders: Technical Leadership (Dev Lead), Product Security Strategy
Rationale
The evangelizing security lead builds a team of security evangelists and scales the practice, supported by technical leadership and assisted by product security strategy.Design
Threat Assessment
- Lead: Product Security Strategy
- Stakeholders: Organizational Security Strategy, Product Ownership, Architecture
Rationale
Product security strategy takes the lead, collaborating with organizational security strategy (which defines the overall risk appetite). Product ownership assists with mapping risk profiles to requirements. Architecture provides technical guidance.- Lead: Architecture
- Stakeholders: Offensive Security Testing, Product Ownership, Technical Leadership (Dev Lead)
Rationale
Architecture leads the threat modeling practice. Offensive security testing contributes realistic threat scenarios. Product ownership helps define threat risk. Technical leadership plays a supporting role.Security Requirements
- Lead: Architecture
- Stakeholders: Product Ownership, Evangelizing Security, Defensive Security Testing
Rationale
Architecture advises product ownership on security requirements. Evangelizing security helps refine them in the team. Defensive security testing supports from their knowledge domain.- Lead: Vendor Management
- Stakeholders: Cybersecurity Regulatory Compliance, Product Security Strategy
Rationale
Vendor management has the end assignment, advised on security matters by cybersecurity regulatory compliance and product security strategy.Secure Architecture
- Lead: Architecture
- Stakeholders: Technical Leadership (Dev Lead)
Rationale
Security is a core component of any architecture. Architecture and technical leadership both need to build up security knowledge as the organization matures.- Lead: Architecture
- Stakeholders: Defensive Security Testing, Technical Leadership (Dev Lead)
Rationale
Technology management assesses technological risks, where defensive security testing can help. Architecture remains the lead, with technical leadership involved.Implementation
Secure Build
- Lead: Build System and Automation
- Stakeholders: Technical Leadership (Dev Lead), Architecture
Rationale
Build system and automation sets up the build and deploy pipelines. Technical leadership is closely involved. Architecture has a secondary role as certain architectural considerations may be essential for CI/CD.- Lead: Build System and Automation
- Stakeholders: Architecture, Cybersecurity Regulatory Compliance, Technical Leadership (Dev Lead)
Rationale
Cybersecurity regulatory compliance is included due to licensing impact.Secure Deployment
- Lead: Build System and Automation
- Stakeholders: Architecture, Technical Leadership (Dev Lead)
Rationale
Build system and automation leads the deployment pipelines. Technical leadership is closely involved. Architecture has a secondary role for CI/CD considerations.- Lead: Build System and Automation
- Stakeholders: Architecture, Technical Leadership (Dev Lead)
Rationale
The same responsibilities as deployment process, but architecture plays a more essential role due to the interplay between secret management and architectural decisions.Defect Management
- Lead: Technical Leadership (Dev Lead)
- Stakeholders: Evangelizing Security, Defensive Security Testing
Rationale
Technical leadership is the primary responsible for defect tracking, in close collaboration with evangelizing security. Defensive security testing plays a secondary role.- Lead: Evangelizing Security
- Stakeholders: Product Security Strategy, Technical Leadership (Dev Lead)
Rationale
This is the team-level equivalent of G-SM-B. Evangelizing security functions as the liaison between product security strategy and technical leadership.Verification
Architecture Assessment
- Lead: Defensive Security Testing
- Stakeholders: Architecture, Technical Leadership (Dev Lead)
Rationale
While this is in the architecture domain, defensive security testing leads in the verification phase. Technical leadership is closely involved: what their team has built based on the architecture is what gets evaluated.- Lead: Offensive Security Testing
- Stakeholders: Architecture
Rationale
The offensive counterpart of architecture validation.Requirements Testing
- Lead: Defensive Security Testing
- Stakeholders: Technical Leadership (Dev Lead)
Rationale
Defensive security testing leads manual and automated verification. Technical leadership ensures all requirements translate to security test cases.- Lead: Offensive Security Testing
- Stakeholders: Technical Leadership (Dev Lead)
Rationale
The offensive counterpart of control verification. Offensive security testing leads to ensure realistic abuse test cases are covered, with technical leadership in the loop for full requirement coverage.Security Testing
- Lead: Defensive Security Testing
- Stakeholders: Build System and Automation, Product Security Strategy, Technical Leadership (Dev Lead)
Rationale
Defensive security testing advises on test tooling and helps with triaging results. Build system and automation integrates the tooling. Product security strategy and technical leadership determine response times and KPIs.- Lead: Offensive Security Testing
- Stakeholders: Technical Leadership (Dev Lead), Architecture
Rationale
Offensive security testing leads maturation of this stream. Technical leadership and architecture define critical components and ensure flagged issues get resolved.Operations
Incident Management
- Lead: Security Operations
- Stakeholders: Infrastructure, Technical Leadership (Dev Lead)
Rationale
Security operations handles daily incident detection. Infrastructure and technical leadership provide integrations and logging, and are pulled in when incidents are detected.- Lead: Security Operations
- Stakeholders: Infrastructure, Technical Leadership (Dev Lead), Organizational Security Strategy
Rationale
Security operations leads initial incident response. Infrastructure and technical leadership are second-line responders. Organizational security strategy helps define contingency scenarios.Environment Management
- Lead: Infrastructure
- Stakeholders: Technical Leadership (Dev Lead), Architecture
Rationale
Infrastructure leads configuration hardening. Technical leadership and architecture ensure applications maintain the required level of hardening.- Lead: Infrastructure
- Stakeholders: Technical Leadership (Dev Lead), Architecture, Security Operations
Rationale
Patching and updating is carried out by infrastructure. Technical leadership and architecture are involved in planning. Security operations provides threat intelligence.Operational Management
- Lead: Cybersecurity Regulatory Compliance
- Stakeholders: Architecture, Technical Leadership (Dev Lead), Infrastructure
Rationale
Data protection is largely led by legal and compliance. Technical leadership creates and maintains data catalogs. Infrastructure handles backups and their timely destruction.B: System Decommissioning / Legacy Management
- Lead: Product Ownership
- Stakeholders: Technical Leadership (Dev Lead), Infrastructure