Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

NIST SSDF and OWASP SAMM as views over the same controls — nothing here is recomputed.

51% of what was assessed

10 requirements were assessed of 15. The percentage is over those and nothing else.

OWASP · version 2.0

2 satisfied
6 partly covered
2 not satisfied
3 beyond your profile
2 not measured here

Design

2 of 3

Requirement	Status	Controls
TA Threat Assessment	50%	2 of 3 controls counted
SR Security Requirements	0%	1 of 2 controls counted

Implementation

2 of 3

Requirement	Status	Controls
SB Secure Build	75%	2 of 8 controls counted
SD Secure Deployment	33%	3 of 13 controls counted

Verification

2 of 3

Requirement	Status	Controls
RT Requirements-driven Testing	0%	1 of 4 controls counted
ST Security Testing	53%	5 of 11 controls counted

Operations

2 of 3

Requirement	Status	Controls
IM Incident Management	56%	3 of 9 controls counted
EM Environment Management	43%	7 of 16 controls counted

Three answers, not one red bar

Not satisfied — the control is required here and nothing covers it. Yours, and something you can act on.
Beyond your profile — the framework asks for it and your own baseline did not. The framework is stricter than your baseline; no control has failed.
Not measured here — no control in this catalog speaks to the requirement. That is our limit, not your failing, and it is kept out of the percentage.

SD Secure Deployment

in Implementation

Deploy through an automated, integrity-checked process where what reaches production is demonstrably what was built, and keep the secrets that deployment needs out of source and under management. Streams: Deployment Process; Secret Management.

Partly covered — 33%. The controls beneath it are covered in some of the places your profile required them and not in others.

No single control answers this requirement outright, so the 3 partial mappings your profile required are averaged.

Closing the 2 scopes listed here would move your overall coverage by 0.5 percentage points — exactly, over the same denominator the headline uses.

Counted toward this requirement

These produced the number above.

Central Secret Storage3 of 3 scopes
Partial mapping · high confidence
What it is
Application and pipeline credentials live in a managed secret store and are injected at run time rather than stored with the code or the configuration.
Why it matters
Credentials kept in repositories, CI variables and configuration files spread quietly, cannot be rotated together, and outlive the people who set them.
Why it maps The core of SD-B: secrets held in a managed store rather than in configuration or code.
Covered everywhere your profile required it.
Secret Rotation0 of 1 scopes
Partial mapping · high confidence
What it is
Credentials are rotated on a defined interval and immediately after a suspected exposure.
Why it matters
A credential that never changes gives whoever obtained it once access for as long as the system lives.
Why it maps SD-B at higher maturity expects lifecycle management, not just storage.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
any any Operate Runtime
In place looks like Credentials have a defined maximum age and are replaced automatically before it, and a suspected exposure triggers rotation the same day.
Secret Access Auditing0 of 1 scopes
Partial mapping · high confidence
What it is
Every access to a stored secret is logged with its identity so unusual use can be detected.
Why it matters
Without a record of who read which secret and when, a suspected leak can neither be confirmed nor bounded.
Why it maps SD-B expects access to secrets to be limited and auditable.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
any any Operate Runtime
In place looks like Every read is logged with the requesting identity, the time and the secret, the log is shipped somewhere outside the secret store itself, and unusual access raises an alert.

Your profile never required these

The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.

Signature Verified Before Executionnot required
Partial mapping · high confidence
Why it maps SD-A integrity verification: what runs is what was built and signed.
Provenance Verified Before Deploynot required
Partial mapping · high confidence
Why it maps SD-A integrity verification, checked at the deployment boundary rather than trusted.
Desired State Repository Protectionnot required
Partial mapping · medium confidence
Why it maps SD-A wants deployment to run from a controlled, auditable definition rather than from operator action.

Supporting only, never counted

A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.

Deployment Change Approvalnot required
Supporting · medium confidence
Why it maps The segregation of duties SD-A expects at higher maturity, for changes reaching a protected environment.
Admission Policy Enforcement0 of 3 scopes
Supporting · medium confidence
Why it maps A last enforcement point on the deployment path for what may enter the environment.
Pre-Commit Secret Detection0 of 1 scopes
Supporting · medium confidence
Why it maps Keeps secrets out of the source that feeds deployment — the SD-B entry condition.
Repository Secret Scanning1 of 1 scopes
Supporting · medium confidence
Why it maps Finds the secrets that were committed before the practice existed.