# Assessing the Secure Software Lifecycle

There are different assessment approaches to evaluate the maturity of the secure development lifecycle:

* Software Assurance Maturity Model (SAMM).
* Building Security in Maturity Model (BSIMM).
* Common Criteria (CC).

## SAMM

**Assessment of a development process.**

1. Define and **measure security-related activities** within an organization.
2. **Evaluate** their existing software **security practices**.
3. **Build** a balanced software **security program** in well-defined iterations.
4. **Demonstrate improvements** in a security assurance program.

Uses 12 security practices grouped into one of 4 business functions.

* Governance
* Construction
* Verification
* Deployment

Provides an organization maturity level (0 to 3).

<figure><img src="https://1055198255-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuV5xU0WcBm5EwmO8bq5p%2Fuploads%2Fdm1dj1e3nHxau2p3I0wB%2F2023-09-16_15-37.png?alt=media&#x26;token=75f8db9b-5ee7-4e53-835b-f1f44933da6b" alt=""><figcaption></figcaption></figure>

## BSIMM

Assessment of a development process based on SAMM

Uses 12 security practices grouped into one of 4 business functions;

* Governance
* Intelligence
* Secure software development lifecycle touchpoints.
* Deployment

Provides comparison to other BSIMM-assessed companies.

### CC

Provides means for international recognition of secure information technology.

Authorized Certification/ Validation Body.

Reuse of certified/ validated products with no further evaluation.

Based on Evaluation Assurance Levels (EAL):

1. Functionally tested.
2. Structurally tested.
3. Methodically tested and checked.
4. Methodically designed, tested, and reviewed.
5. Semi-formally designed and tested.
6. Semi-formally verified design and tested.
7. Formally verified design and tested.
