Key Facts
- Regulator
- Black Duck (publisher of the BSIMM report and assessment services)
- Latest version
- BSIMM16 (16th edition)
- Effective
- 4 February 2026
- Official text
- www.blackduck.com ↗
What is BSIMM?
BSIMM, the Building Security in Maturity Model, is a data-driven model of real-world software security initiatives. Black Duck publishes it, and organisations use it to measure and benchmark their software security programmes against peers. It suits organisations that run a software security initiative; it is voluntary and descriptive rather than a regulatory requirement.
The current version is BSIMM16, the 16th edition, published in January 2026. It rests on data from 111 organisations across a range of sectors.
BSIMM is descriptive, not prescriptive. It records what organisations with successful software security initiatives (SSIs) do in practice. It does not tell you what you ought to do, which makes it a measuring stick rather than a rulebook.
A scorecard is a mirror, not a plan.
Why it matters
BSIMM matters when someone asks how your software security compares and you have only tools to point at. A scanner licence, a penetration test and a policy are inputs. They do not tell a board or a customer where the programme stands against similar organisations.
BSIMM gives that comparison a common language. Black Duck's BSIMM page says the model lets you see precisely where you stand relative to industry peers. Its data runs from Fortune 500 enterprises to midmarket companies building their first formal programme, and financial services is one of the largest participating sectors.
The limit is worth knowing early. BSIMM does not map directly to specific regulatory requirements, so it will not answer a regulator's question on its own.
Who it applies to
BSIMM suits organisations that run a software security initiative, or want to start measuring one, and want to compare it with peers. In practice that means companies that build software for their own use or for customers. It is a poor fit for a firm that only buys and configures software, and for anyone looking for a certificate: an assessment ends in a scorecard, not a certification.
The obligation is voluntary. No law or regulator requires BSIMM, and the model is descriptive. Organisations in regulated industries often use it alongside compliance frameworks rather than as a substitute for them.
ISO 27001 certifies an information security management system, and its nearest control, A.8.25 Secure development life cycle, asks you to set rules for developing software securely. BSIMM sits beside that control rather than inside it; for the management-system view, see the ISO 27001 vault.
The UK position
No UK law or regulator that we have found names BSIMM. A UK firm meets it voluntarily: a security lead benchmarking a software security initiative, or a customer or board asking for an external yardstick.
Either way, the request is commercial, not legal.
Key requirements
BSIMM has no mandatory requirements, because it describes practice rather than prescribing it. What it has is a structure:
- Four domains: Governance, Intelligence, SSDL Touchpoints and Deployment.
- 12 practices spread across those domains.
- 128 activities, the things organisations are observed doing within the practices.
An assessment follows a set path. BSIMM consultants begin with in-depth interviews with key stakeholders across your organisation. The result is a scorecard showing which activities you perform and your maturity in each practice, which you can then compare with industry peers.
Read the scorecard as a map of what you do and what peers do. A gap shows where peers act and you don't. It is a comparison, not a failure against a standard.
BSIMM and OWASP SAMM
BSIMM and the OWASP Software Assurance Maturity Model (SAMM) are complementary frameworks that serve different purposes. BSIMM is descriptive: it shows what successful organisations do. SAMM is prescriptive: it sets out what to do. The two answer different questions, so choosing between them is less useful than knowing which question you are asking.
Frequently asked questions
In BSIMM, a software security initiative (SSI) is an organised, strategic application security programme that builds security into the software development life cycle. A BSIMM initiative usually centres on a software security group (SSG) of dedicated security professionals, but effective ones reach beyond that group to embedded security champions and automated tools.
Only indirectly. BSIMM does not map directly to specific regulatory requirements, so a BSIMM scorecard does not show compliance with any one law. It helps in two narrower ways: BSIMM's Compliance and Policy practice holds activities for regulated environments, and Black Duck says the peer data supports the case made to executives and regulators.
The difference is where each comes from. BSIMM is built from practices observed in real organisations, so a BSIMM scorecard shows how your programme compares with theirs. OWASP SAMM was developed by security experts who define what organisations should do to reach software security maturity. BSIMM answers where you stand; SAMM answers what to do next.
BSIMM16, the 16th edition, is the current version, published in January 2026. Black Duck's page for it does not state a revision in progress, so BSIMM16 is the edition to cite when a customer, board or assessor asks for a BSIMM benchmark of your software security programme.
No. A BSIMM assessment ends in a scorecard, not a certificate, so BSIMM cannot stand in for ISO 27001 certification in a tender or customer review. The two work together for an ISO 27001 holder that builds software: the ISMS sets the secure development rules, and BSIMM shows how far that practice has gone compared with peers.