Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

NIST SSDF and OWASP SAMM as views over the same controls — nothing here is recomputed.

57% of what was assessed

10 requirements were assessed of 19. The percentage is over those and nothing else.

NIST · version 1.1

2 satisfied
6 partly covered
2 not satisfied
7 beyond your profile
2 not measured here

PW Produce Well-Secured Software

1 of 8

Requirement	Status	Controls
PW.2 Review the Software Design to Verify Compliance with Security Requirements and Risk Information	100%	1 of 2 controls counted

RV Respond to Vulnerabilities

1 of 3

Requirement	Status	Controls
RV.2 Assess, Prioritize, and Remediate Vulnerabilities	100%	3 of 7 controls counted

Three answers, not one red bar

Not satisfied — the control is required here and nothing covers it. Yours, and something you can act on.
Beyond your profile — the framework asks for it and your own baseline did not. The framework is stricter than your baseline; no control has failed.
Not measured here — no control in this catalog speaks to the requirement. That is our limit, not your failing, and it is kept out of the percentage.

RV.2 Assess, Prioritize, and Remediate Vulnerabilities

in Respond to Vulnerabilities

Analyze each vulnerability for enough risk information to plan a response, then plan and implement that response.

Satisfied. Every control this requirement counts on is covered everywhere your profile required it.

No single control answers this requirement outright, so the 3 partial mappings your profile required are averaged.

Nothing is left open under the controls this requirement counts on.

Counted toward this requirement

These produced the number above.

Central Finding Routing6 of 6 scopes
Partial mapping · high confidence
What it is
Findings from every source are routed into one place with a named owner, instead of staying in the tool that produced them.
Why it matters
Findings that stay in the tool that produced them are seen only by whoever opens that tool, and nobody can say what the whole backlog is.
Why it maps RV.2.2 requires a planned response per vulnerability, which presupposes the named owner routing establishes.
Covered everywhere your profile required it.
Finding SLA Tracking3 of 3 scopes
Partial mapping · high confidence
What it is
Each finding carries a remediation deadline derived from its severity, and overdue findings are visible.
Why it matters
Without a deadline tied to severity, the order of remediation is decided by convenience and critical findings age quietly.
Why it maps A severity-derived deadline is the prioritization RV.2 names, and overdue visibility is what makes the response actually happen.
Covered everywhere your profile required it.
Automated Dependency Updates9 of 9 scopes
Partial mapping · medium confidence
What it is
Outdated or vulnerable dependencies are proposed for upgrade automatically so that remediation does not depend on someone noticing.
Why it matters
Manual upgrades happen when somebody has time, which is why dependencies fall years behind and a single upgrade turns into a project.
Why it maps RV.2.2 is about implementing the response, not only planning it; an automated upgrade proposal is the response for the most common finding class.
Covered everywhere your profile required it.

Your profile never required these

The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.

Exploitability Context in Triagenot required
Partial mapping · high confidence
Why it maps RV.2.1 asks for enough risk information to plan a response; whether the vulnerable code is reachable is the largest part of that.

Supporting only, never counted

A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.

Finding Deduplicationnot required
Supporting · medium confidence
Why it maps Prioritization over a backlog that counts one weakness several times prioritizes the wrong things.
Penetration Test Remediation Tracking0 of 3 scopes
Supporting · medium confidence
Why it maps RV.2 makes no distinction by source; holding manual findings to the same SLA closes the gap tool findings would otherwise leave.
IaC Exception Managementnot required
Supporting · medium confidence
Why it maps RV.2.2 counts accepting a risk as a valid response; a time-bounded approved exception is what makes acceptance a decision rather than an omission, though only for infrastructure findings.