Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

NIST SSDF and OWASP SAMM as views over the same controls — nothing here is recomputed.

51% of what was assessed

10 requirements were assessed of 15. The percentage is over those and nothing else.

OWASP · version 2.0

2 satisfied
6 partly covered
2 not satisfied
3 beyond your profile
2 not measured here

Governance

3 of 3

Requirement	Status	Controls
SM Strategy and Metrics	not measured here	nothing maps
PC Policy and Compliance	beyond your profile	6 controls, none counted
EG Education and Guidance	beyond your profile	3 controls, none counted

Design

3 of 3

Requirement	Status	Controls
TA Threat Assessment	50%	2 of 3 controls counted
SR Security Requirements	0%	1 of 2 controls counted
SA Security Architecture	beyond your profile	3 controls, none counted

Implementation

3 of 3

Requirement	Status	Controls
SB Secure Build	75%	2 of 8 controls counted
SD Secure Deployment	33%	3 of 13 controls counted
DM Defect Management	100%	2 of 6 controls counted

Verification

3 of 3

Requirement	Status	Controls
AA Architecture Assessment	100%	1 of 3 controls counted
RT Requirements-driven Testing	0%	1 of 4 controls counted
ST Security Testing	53%	5 of 11 controls counted

Operations

3 of 3

Requirement	Status	Controls
IM Incident Management	56%	3 of 9 controls counted
EM Environment Management	43%	7 of 16 controls counted
OM Operational Management	not measured here	nothing maps

Three answers, not one red bar

Not satisfied — the control is required here and nothing covers it. Yours, and something you can act on.
Beyond your profile — the framework asks for it and your own baseline did not. The framework is stricter than your baseline; no control has failed.
Not measured here — no control in this catalog speaks to the requirement. That is our limit, not your failing, and it is kept out of the percentage.

PC Policy and Compliance

in Governance

Set internal security standards and policies that development is measured against, and manage conformance with the external regulations and third-party obligations the organisation is subject to, including audit and reporting. Streams: Policy and Standards; Compliance Management.

Beyond your profile. The catalog maps controls to this requirement, but your own baseline never required any of them — the framework is stricter than your baseline, not a control that has failed.

Nothing is left open under the controls this requirement counts on.

Your profile never required these

The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.

Policies Defined as Codenot required
Partial mapping · medium confidence
Why it maps Expresses organisational policy in a machine-checkable, versioned form, which is what PC-A means by standards that development can be measured against. It does not establish the policy set, its ownership, or the Compliance Management stream.
Secure Coding Standard Publishednot required
Partial mapping · medium confidence
Why it maps PC-A asks for security standards derived from policy and published for developers; a secure coding standard is one such standard, not the whole set.

Supporting only, never counted

A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.

Policy Gate at Releasenot required
Supporting · medium confidence
Why it maps An enforcement point that makes a published policy binding rather than advisory.
License Policy Enforcementnot required
Supporting · medium confidence
Why it maps Covers exactly one obligation — third-party licence terms — out of everything PC-B calls compliance management.
IaC Exception Managementnot required
Supporting · low confidence
Why it maps A documented, time-bounded exception path is part of governing a standard, but this one governs infrastructure-as-code findings only, not the policy set as a whole.
Coding Standard Applied in Reviewnot required
Supporting · medium confidence
Why it maps Evidence that a published standard is actually applied rather than merely written.