Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

NIST SSDF and OWASP SAMM as views over the same controls — nothing here is recomputed.

51% of what was assessed

10 requirements were assessed of 15. The percentage is over those and nothing else.

OWASP · version 2.0

2 satisfied
6 partly covered
2 not satisfied
3 beyond your profile
2 not measured here

Governance

2 of 3

Requirement	Status	Controls
PC Policy and Compliance	beyond your profile	6 controls, none counted
EG Education and Guidance	beyond your profile	3 controls, none counted

Design

1 of 3

Requirement	Status	Controls
SA Security Architecture	beyond your profile	3 controls, none counted

Three answers, not one red bar

Not satisfied — the control is required here and nothing covers it. Yours, and something you can act on.
Beyond your profile — the framework asks for it and your own baseline did not. The framework is stricter than your baseline; no control has failed.
Not measured here — no control in this catalog speaks to the requirement. That is our limit, not your failing, and it is kept out of the percentage.

SA Security Architecture

in Design

Design the software along established security principles and patterns, and manage the technologies it is built from — standardised components, shared security services and secure-by-default frameworks. Streams: Architecture Design; Technology Management.

Beyond your profile. The catalog maps controls to this requirement, but your own baseline never required any of them — the framework is stricter than your baseline, not a control that has failed.

Nothing is left open under the controls this requirement counts on.

Your profile never required these

The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.

Architecture Security Baselinenot required
Partial mapping · high confidence
Why it maps A documented baseline of security patterns and defaults is what SA-A asks designs to be built from.

Supporting only, never counted

A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.

Security Architecture Review1 of 1 scopes
Supporting · medium confidence
Why it maps Feeds security principles into the design while it is still malleable; the formal validation of a finished architecture belongs to AA.
Approved Base Image Baselinenot required
Supporting · medium confidence
Why it maps SA-B is technology management — a curated set of approved, maintained building blocks. An approved base image set is one instance of that for one technology.