BSIMM16 Scorecard.xlsx

	A	B	C	D	E	F	G	H	I	J	K	L	M
1	Order	Domain	Practice	Activity ID	Activity Name	Observations	Percent	Performed	Maturity (0 - 3)	Coverage	Owner	Evidence	Notes
2	1	Governance	Strategy & Metrics	SM1.1	Publish process and evolve as necessary.	84	75.7%	Yes	1
3	2	Governance	Strategy & Metrics	SM1.3	Educate executives on software security.	66	59.5%	No	0
4	3	Governance	Strategy & Metrics	SM1.4	Implement security checkpoints and associated governance.	100	90.1%	Yes	3
5	4	Governance	Strategy & Metrics	SM1.7	Enforce security checkpoints and track exceptions.	71	64.0%	Yes	2
6	5	Governance	Strategy & Metrics	SM2.1	Publish data about software security internally and use it to drive change.	54	48.7%	No	0
7	6	Governance	Strategy & Metrics	SM2.3	Create or grow a security champions program.	55	49.6%
8	7	Governance	Strategy & Metrics	SM2.6	Require security sign-off prior to software release.	62	55.9%
9	8	Governance	Strategy & Metrics	SM2.7	Create evangelism role and perform internal marketing.	49	44.1%
10	9	Governance	Strategy & Metrics	SM3.1	Use a software asset tracking application with portfolio view.	31	27.9%
11	10	Governance	Strategy & Metrics	SM3.2	Make SSI efforts part of external marketing.	25	22.5%
12	11	Governance	Strategy & Metrics	SM3.3	Identify metrics and use them to drive resourcing.	30	27.0%
13	12	Governance	Strategy & Metrics	SM3.4	Integrate software-defined lifecycle governance.	9	8.1%
14	13	Governance	Strategy & Metrics	SM3.5	Integrate software supply chain risk management.	5	4.5%
15	14	Governance	Compliance & Policy	CP1.1	Unify regulatory pressures.	88	79.3%
16	15	Governance	Compliance & Policy	CP1.2	Identify privacy obligations.	94	84.7%
17	16	Governance	Compliance & Policy	CP1.3	Create policy.	92	82.9%
18	17	Governance	Compliance & Policy	CP2.1	Build a PII inventory.	46	41.4%
19	18	Governance	Compliance & Policy	CP2.2	Require security sign-off for compliance-related risk.	56	50.5%
20	19	Governance	Compliance & Policy	CP2.3	Implement and track controls for compliance.	63	56.8%
21	20	Governance	Compliance & Policy	CP2.4	Include software security SLAs in all vendor contracts.	61	55.0%
22	21	Governance	Compliance & Policy	CP2.5	Ensure executive awareness of compliance and privacy obligations.	68	61.3%
23	22	Governance	Compliance & Policy	CP3.1	Document a software compliance story.	40	36.0%
24	23	Governance	Compliance & Policy	CP3.2	Ensure compatible vendor policies.	41	36.9%
25	24	Governance	Compliance & Policy	CP3.3	Drive feedback from software lifecycle data back to policy.	15	13.5%
26	25	Governance	Training	T1.1	Conduct software security awareness training.	61	55.0%
27	26	Governance	Training	T1.7	Deliver on-demand individual training.	61	55.0%
28	27	Governance	Training	T1.8	Include security resources in onboarding.	52	46.9%
29	28	Governance	Training	T2.5	Enhance security champions through training and events.	30	27.0%
30	29	Governance	Training	T2.8	Create and use material specific to company history.	25	22.5%
31	30	Governance	Training	T2.9	Deliver role-specific advanced curriculum.	30	27.0%
32	31	Governance	Training	T2.10	Host software security events.	21	18.9%
33	32	Governance	Training	T2.11	Require an annual refresher.	30	27.0%
34	33	Governance	Training	T2.12	Provide expertise via open collaboration channels.	45	40.5%
35	34	Governance	Training	T3.1	Reward progression through curriculum.	8	7.2%
36	35	Governance	Training	T3.2	Provide training for vendors and outsourced workers.	21	18.9%
37	36	Governance	Training	T3.6	Identify new security champions through observation.	8	7.2%
38	37	Intelligence	Attack Models	AM1.2	Use a data classification scheme for software inventory.	57	51.4%
39	38	Intelligence	Attack Models	AM1.3	Identify potential attackers.	44	39.6%
40	39	Intelligence	Attack Models	AM1.5	Gather and use attack intelligence.	78	70.3%
41	40	Intelligence	Attack Models	AM2.1	Build attack patterns and abuse cases tied to potential attackers.	20	18.0%
42	41	Intelligence	Attack Models	AM2.6	Collect and publish attack stories.	16	14.4%
43	42	Intelligence	Attack Models	AM2.7	Build an internal forum to discuss attacks.	18	16.2%
44	43	Intelligence	Attack Models	AM2.8	Have a research group that develops new attack methods.	26	23.4%
45	44	Intelligence	Attack Models	AM2.9	Monitor automated asset creation.	22	19.8%
46	45	Intelligence	Attack Models	AM3.2	Create and use automation to mimic attackers.	5	4.5%
47	46	Intelligence	Attack Models	AM3.4	Create technology-specific attack patterns.	9	8.1%
48	47	Intelligence	Attack Models	AM3.5	Maintain and use a top N possible attacks list.	12	10.8%
49	48	Intelligence	Security Features & Design	SFD1.1	Integrate and deliver security features.	85	76.6%
50	49	Intelligence	Security Features & Design	SFD1.2	Application architecture teams engage with the SSG.	77	69.4%
51	50	Intelligence	Security Features & Design	SFD2.1	Leverage secure-by-design components and services.	44	39.6%
52	51	Intelligence	Security Features & Design	SFD2.2	Create capability to solve difficult design problems.	62	55.9%
53	52	Intelligence	Security Features & Design	SFD3.1	Form a review board to approve and maintain secure design patterns.	16	14.4%
54	53	Intelligence	Security Features & Design	SFD3.2	Require use of approved security features and frameworks.	22	19.8%
55	54	Intelligence	Security Features & Design	SFD3.3	Find and publish secure design patterns from the organization.	11	9.9%
56	55	Intelligence	Standards & Requirements	SR1.1	Create security standards.	82	73.9%
57	56	Intelligence	Standards & Requirements	SR1.2	Create a security portal.	88	79.3%
58	57	Intelligence	Standards & Requirements	SR1.3	Translate compliance constraints to requirements.	77	69.4%
59	58	Intelligence	Standards & Requirements	SR1.5	Identify open source.	88	79.3%
60	59	Intelligence	Standards & Requirements	SR2.2	Create a standards review process.	65	58.6%
61	60	Intelligence	Standards & Requirements	SR2.5	Create SLA boilerplate.	62	55.9%
62	61	Intelligence	Standards & Requirements	SR2.7	Control open source risk.	53	47.8%
63	62	Intelligence	Standards & Requirements	SR3.2	Communicate standards to vendors.	17	15.3%
64	63	Intelligence	Standards & Requirements	SR3.3	Use secure coding standards.	19	17.1%
65	64	Intelligence	Standards & Requirements	SR3.4	Create standards for technology stacks.	26	23.4%
66	65	Intelligence	Standards & Requirements	SR3.5	Create standards controlling and guiding the adoption of new technologies.	2	1.8%
67	66	SSDL Touchpoints	Architecture Analysis	AA1.1	Perform security feature review.	89	80.2%
68	67	SSDL Touchpoints	Architecture Analysis	AA1.2	Perform design review for high-risk applications.	51	46.0%
69	68	SSDL Touchpoints	Architecture Analysis	AA1.4	Use a risk methodology to rank applications.	57	51.4%
70	69	SSDL Touchpoints	Architecture Analysis	AA2.1	Perform architecture analysis using a defined process.	35	31.5%
71	70	SSDL Touchpoints	Architecture Analysis	AA2.2	Standardize architectural descriptions.	38	34.2%
72	71	SSDL Touchpoints	Architecture Analysis	AA2.4	Have SSG lead design review efforts.	36	32.4%
73	72	SSDL Touchpoints	Architecture Analysis	AA3.1	Have engineering teams lead AA process.	17	15.3%
74	73	SSDL Touchpoints	Architecture Analysis	AA3.2	Drive analysis results into standard design patterns.	7	6.3%
75	74	SSDL Touchpoints	Architecture Analysis	AA3.3	Make the SSG available as an AA resource or mentor.	14	12.6%
76	75	SSDL Touchpoints	Code Review	CR1.2	Perform opportunistic code review.	75	67.6%
77	76	SSDL Touchpoints	Code Review	CR1.4	Use automated code review tools.	95	85.6%
78	77	SSDL Touchpoints	Code Review	CR1.5	Make code review mandatory for all projects.	74	66.7%
79	78	SSDL Touchpoints	Code Review	CR1.7	Assign code review tool mentors.	47	42.3%
80	79	SSDL Touchpoints	Code Review	CR2.6	Use custom rules with automated code review tools.	29	26.1%
81	80	SSDL Touchpoints	Code Review	CR2.7	Use a top N bugs list (real data preferred).	19	17.1%
82	81	SSDL Touchpoints	Code Review	CR2.8	Use centralized defect reporting to close the knowledge loop.	28	25.2%
83	82	SSDL Touchpoints	Code Review	CR3.2	Build a capability to combine AST results.	18	16.2%
84	83	SSDL Touchpoints	Code Review	CR3.3	Create capability to eradicate bugs.	8	7.2%
85	84	SSDL Touchpoints	Code Review	CR3.4	Automate malicious code detection.	3	2.7%
86	85	SSDL Touchpoints	Code Review	CR3.5	Enforce secure coding standards.	4	3.6%
87	86	SSDL Touchpoints	Security Testing	ST1.1	Perform edge/boundary value condition testing during QA.	93	83.8%
88	87	SSDL Touchpoints	Security Testing	ST1.3	Drive tests with security requirements and security features.	66	59.5%
89	88	SSDL Touchpoints	Security Testing	ST1.4	Integrate opaque-box security tools into the QA process.	47	42.3%
90	89	SSDL Touchpoints	Security Testing	ST2.4	Drive QA tests with AST results.	20	18.0%
91	90	SSDL Touchpoints	Security Testing	ST2.5	Include security tests in QA automation.	30	27.0%
92	91	SSDL Touchpoints	Security Testing	ST2.6	Perform fuzz testing customized to application APIs.	28	25.2%
93	92	SSDL Touchpoints	Security Testing	ST3.3	Drive tests with design review results.	15	13.5%
94	93	SSDL Touchpoints	Security Testing	ST3.4	Leverage code coverage analysis.	6	5.4%
95	94	SSDL Touchpoints	Security Testing	ST3.5	Begin to build and apply adversarial security tests (abuse cases).	9	8.1%
96	95	SSDL Touchpoints	Security Testing	ST3.6	Implement event-driven security testing in automation.	10	9.0%
97	96	Deployment	Penetration Testing	PT1.1	Use external penetration testers to find problems.	95	85.6%
98	97	Deployment	Penetration Testing	PT1.2	Feed results to the defect management and mitigation system.	87	78.4%
99	98	Deployment	Penetration Testing	PT1.3	Use penetration testing tools internally.	67	60.4%
100	99	Deployment	Penetration Testing	PT2.2	Penetration testers use all available information.	40	36.0%