BSAMM · Building Security Assurance Maturity Model
Security is justified confidence, built across your technical exposures
Information security is a complicated subject, but we can chip it apart by building assurance in small pieces — earned, measurable confidence. This cuts across several technology domains, and these are guides to think about it the right way.
Evaluate your risks,
take the next step forward
BSAMM is not a checklist or a certification. There are no boxes to tick and no benchmarks to measure against. It is a way to reason about where you stand in each area and to decide, for yourself, what "better" should mean next — improving in iterations, choosing what your organization actually needs each cycle.
Learn each area
Understand how security really works in each domain, from first principles rather than controls lists.
Decide for yourself
Judge where you are and where you want to be. The model informs the decision; it does not make it for you.
Improve iteratively
Advance one Maturity Level at a time, in the domains that carry the most risk for you right now.
Improve your company's security posture, with specific steps
Your technical exposure falls into six domains. Within every domain the same structure applies: four Business Functions, each with three Security Practices, each measured across three Maturity Levels.
Endpointsevery organization — its people all use phones, laptops or tablets.
Infrastructureany organization that runs servers, a website or cloud services.
Dataalmost every organization, and most of all those trusted with data on others' behalf.
Processevery organization — people are always making decisions that affect security.
Vendornearly every organization, since almost all rely on outside technology services.
Softwareorganizations that build their own software, for internal use or to license to others.The four Functions and twelve Practices are the same in every domain — only the specific activities beneath them change. Learn them once and every guide reads the same way.
Library
Read any guide online or download it.
Introduction
A guide to building security across the whole organization. It sets out the shared framework every domain guide builds on — the four Business Functions, the twelve Security Practices and the three Maturity Levels — and how to assess where you stand and build an assurance program. Read it first.
Domain Guides
Six companion guides, one per domain. Each applies the shared framework to a specific area of technical exposure — read the Introduction first, then whichever domains matter most to you.
