Abstract
OWASP SAMM tells you how mature your application security practice is. The EU Cyber Resilience Act asks whether you can prove it. Its expectations around governance, accountability, and evidence go beyond what a maturity assessment produces on its own. The EN 40000 series of horizontal standards from CEN and CENELEC gives you a skeleton for a product security program that is auditable and can produce evidence on demand.
This session shows how to combine SAMM with the EN 40000 standards to build risk-driven, secure-by-design, audit-ready processes for CRA compliance.
Speaker Bio
Nariman is a core team member of the OWASP SAMM (Software Assurance Maturity Model) project, member of the CEN/CENELEC EU CRA and ISO/IEC 27034 working groups. He holds the ISC2 Certified Secure Software Development Lifecycle (SSDLC) certification. In addition, he founded SecureHabits, a company that helps industrial manufacturers prepare for compliance with the EU Cyber Resilience Act (CRA) by embedding security into their product development processes.