Expertise 06 · Governance
Make application security owned, measured and funded
Tools move only part of the picture. I check who owns application security, how it is measured and whether budget follows risk, using OWASP SAMM v2.
In short
Application security governance decides who owns application risk, which standards teams and vendors follow, how practice is measured and how budget follows risk. I assess it with SAMM v2, the Software Assurance Maturity Model from OWASP (the Open Worldwide Application Security Project), scoring each practice against evidence, then map results to the NIST (National Institute of Standards and Technology) Cybersecurity Framework, CSF 2.0, so they fit enterprise risk reporting.
What I check
- Named ownership for application security
- Policy and standards that teams can evidence
- OWASP SAMM v2 maturity per practice
- NIST CSF 2.0 Govern alignment
- Security requirements in vendor contracts
- Roadmap and budget tied to risk
The threats
What this area has to stop.
The attacks I see most often in this area, and what they cost when they land.
Open the attack simulator- Threat 01Vendor app goes live untestedContracts carry no security requirements, so vendor releases ship without testing evidence.Flaws inherited from every supplier
- Threat 02Tools bought, practice missingA scanner is licensed, but nobody triages its findings or acts on the results.Spend with no reduction in risk
- Threat 03Findings with no ownerAudit and test findings land in a shared mailbox and age quietly past every deadline.The same issues reported year after year
- Threat 04Insecure design shippedMajor changes go live without threat modelling, so flaws are found by testers or attackers.Expensive rework after launch
- Threat 05Policy on paper onlyA secure coding standard exists, but nobody can show it being applied or checked.False assurance to the board
The defences
How good looks, layer by layer.
- 01Board oversightSets the risk appetite for applications and reviews progress against it.Risk committee reporting, appetite statement
- 02Strategy and policyTurns appetite into standards that teams and vendors must meet.AppSec strategy, secure coding standard
- 03Named ownershipGives every application and every finding an accountable owner.App owners, AppSec lead, security champions
- 04Practices in deliveryBuilds threat modelling, testing and review into how teams already ship.Threat models, pipeline tests, design reviews
- 05MeasurementScores practice against evidence and feeds the result back into strategy.SAMM scores, metrics, annual reassessment
Maturity
Where are you on the staircase?
Four levels I use to score this area. Most improvement plans aim one step up within a year.
- L0Unowned
- No named owner for application security
- Security happens when an audit or incident forces it
- L1Defined
- Policy and an AppSec owner exist; budget is ad hoc
- Some teams follow standards; vendors are not measured
- L2Managed
- SAMM baseline with targets per practice
- Roadmap funded; security terms in vendor contracts
- L3Measured and improving
- Metrics reviewed quarterly with the sponsor
- Annual reassessment shows the board the trend
Measure it
Four numbers worth tracking.
- KPI 01SAMM score per practice vs targetShows where practice is improving and where it stalls. Report per practice, never as an average.
- KPI 02Roadmap initiatives on trackShare of funded initiatives meeting their milestones. Stalled roadmaps are a common failure.
- KPI 03Apps with a named ownerShare of the application inventory with an accountable business owner and technical owner.
- KPI 04Vendor contracts with security termsOutsourced estates are only as secure as what the contract requires and what you check.
Frameworks I assess against
- OWASP SAMM v2
- NIST CSF 2.0
- NIST SSDF
Work with me
How I can help with this area.
- AppSec maturity assessmentI score your application security practices against OWASP SAMM v2 using evidence, not opinion, then turn the gaps into a roadmap your board can fund.2–3 weeksFixed fee
- Fractional AppSec advisorAfter an assessment, I stay on a monthly retainer to keep the roadmap moving, review designs and vendors, and help when something urgent lands.MonthlyRetainer
- Executive briefing or team workshopA plain-language briefing for the board and executives, or a hands-on workshop for engineers, built around your own applications rather than generic slides.½–1 dayFixed fee
What is application security governance?
Application security governance is how an organisation decides who owns application risk, which standards apply to in-house and vendor software, how practice is measured and how budget follows risk. It turns security from a set of tools into an operating discipline. Without it, scanners and firewalls get bought, but findings age, vendors go unchecked and the board cannot see progress.
How does OWASP SAMM relate to NIST CSF 2.0?
They work at different levels. SAMM, the Software Assurance Maturity Model from OWASP (the Open Worldwide Application Security Project), measures software security practices in detail. The NIST (National Institute of Standards and Technology) Cybersecurity Framework, CSF 2.0, describes enterprise outcomes and added a Govern function in 2024. I score with SAMM and map the results to CSF 2.0 Govern, so application security reaches the board in familiar terms.
Who should own application security?
One named executive should be accountable, usually the CISO (chief information security officer) or CIO (chief information officer), with an AppSec (application security) lead running the programme day to day. Every application also needs a business owner who accepts its risk and a technical owner who fixes its findings. Security champions inside each development team make the standards practical.
How do you build an AppSec roadmap the board will fund?
Tie every initiative to a risk the board already recognises, and give it an owner, a cost range and a measurable outcome. Sequence it so early items show progress without large spend. I report current and target maturity on one page, name the top three risks in plain language and state the decisions needed, in the same format every review so the trend is visible.
Does governance matter if development is outsourced?
More, not less. When vendors write and run your applications, your security depends on what contracts require and what you check: security requirements, testing evidence before release, remediation deadlines and the right to audit. SAMM (the Software Assurance Maturity Model) scores this through its Supplier Security stream, so an outsourced estate is measured rather than excused.