Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

NIST SSDF and OWASP SAMM as views over the same controls — nothing here is recomputed.

57% of what was assessed

10 requirements were assessed of 19. The percentage is over those and nothing else.

NIST · version 1.1

2 satisfied
6 partly covered
2 not satisfied
7 beyond your profile
2 not measured here

PO Prepare the Organization

5 of 5

Requirement	Status	Controls
PO.1 Define Security Requirements for Software Development	0%	1 of 3 controls counted
PO.2 Implement Roles and Responsibilities	beyond your profile	2 controls, none counted
PO.3 Implement Supporting Toolchains	beyond your profile	1 control, none counted
PO.4 Define and Use Criteria for Software Security Checks	beyond your profile	4 controls, none counted
PO.5 Implement and Maintain Secure Environments for Software Development	50%	2 of 3 controls counted

PS Protect the Software

3 of 3

Requirement	Status	Controls
PS.1 Protect All Forms of Code from Unauthorized Access and Tampering	beyond your profile	2 controls, none counted
PS.2 Provide a Mechanism for Verifying Software Release Integrity	beyond your profile	3 controls, none counted
PS.3 Archive and Protect Each Software Release	beyond your profile	3 controls, none counted

PW Produce Well-Secured Software

8 of 8

Requirement	Status	Controls
PW.1 Design Software to Meet Security Requirements and Mitigate Security Risks	50%	2 of 4 controls counted
PW.2 Review the Software Design to Verify Compliance with Security Requirements and Risk Information	100%	1 of 2 controls counted
PW.4 Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality	83%	3 of 7 controls counted
PW.5 Create Source Code by Adhering to Secure Coding Practices	0%	1 of 6 controls counted
PW.6 Configure the Compilation, Interpreter, and Build Processes to Improve Executable Security	not measured here	nothing maps
PW.7 Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements	92%	6 of 9 controls counted
PW.8 Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements	28%	6 of 11 controls counted
PW.9 Configure Software to Have Secure Settings by Default	not measured here	2 controls, none counted

RV Respond to Vulnerabilities

3 of 3

Requirement	Status	Controls
RV.1 Identify and Confirm Vulnerabilities on an Ongoing Basis	72%	3 of 8 controls counted
RV.2 Assess, Prioritize, and Remediate Vulnerabilities	100%	3 of 7 controls counted
RV.3 Analyze Vulnerabilities to Identify Their Root Causes	beyond your profile	3 controls, none counted

Three answers, not one red bar

Not satisfied — the control is required here and nothing covers it. Yours, and something you can act on.
Beyond your profile — the framework asks for it and your own baseline did not. The framework is stricter than your baseline; no control has failed.
Not measured here — no control in this catalog speaks to the requirement. That is our limit, not your failing, and it is kept out of the percentage.

PW.7 Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements

in Produce Well-Secured Software

Review or analyze human-readable code against the organization's secure coding standards, and record and triage every issue found in the development team's workflow.

Partly covered — 92%. The controls beneath it are covered in some of the places your profile required them and not in others.

No single control answers this requirement outright, so the 6 partial mappings your profile required are averaged.

Closing the 1 scope listed here would move your overall coverage by 0.2 percentage points — exactly, over the same denominator the headline uses.

Counted toward this requirement

These produced the number above.

SAST Pipeline Scan3 of 3 scopes
Partial mapping · high confidence
What it is
Every build runs static analysis over the application source code and records the result.
Why it matters
Checks in the editor and in review are optional by nature; the pipeline is the one place every change has to pass through.
Why it maps PW.7.2 names static analysis as the automated half of the practice; the manual review half is a separate control.
Covered everywhere your profile required it.
SAST Pull Request Gate3 of 3 scopes
Partial mapping · high confidence
What it is
A change carrying a critical static-analysis finding cannot be merged until the finding is fixed or formally excepted.
Why it matters
A scan that only reports leaves the merge decision to the person under time pressure, so critical findings reach the main branch anyway.
Why it maps PW.7 exists so vulnerabilities are corrected before release; the gate is what makes the analysis result act on the change.
Covered everywhere your profile required it.
Mandatory Peer Review Before Merge1 of 1 scopes
Partial mapping · high confidence
What it is
No change reaches the main branch without the review and approval of a second person.
Why it matters
One person able to put code into production unreviewed is both the easiest mistake to make and the most useful account to compromise.
Why it maps PW.7.1 offers peer review as an alternative or complement to automated analysis.
Covered everywhere your profile required it.
Security Review of Sensitive Changes1 of 2 scopes
Partial mapping · high confidence
What it is
Changes to authentication, authorization, cryptography or data handling additionally require a security-qualified reviewer.
Why it matters
Authentication, authorization, cryptography and data handling fail in ways a general reviewer is not looking for.
Why it maps A security-qualified reviewer on authentication, authorization, cryptography and data handling is the qualified-reviewer form of PW.7.2.
What would close it
The required scopes nothing covers today:
Environment Technology Phase Control point
any any Code Manual Review
In place looks like Changes touching those areas need an approval from a reviewer with security knowledge, and the areas are identified by code-ownership rules rather than by memory.
Repository Secret Scanning1 of 1 scopes
Partial mapping · medium confidence
What it is
The repository and its history are scanned continuously for keys, tokens and passwords, independently of any single change.
Why it matters
Secrets committed before the scanning existed, or on branches nobody reviews, stay valid until somebody deliberately looks for them.
Why it maps A committed credential is a vulnerability in human-readable code, and history scanning finds the ones that predate any current review.
Covered everywhere your profile required it.
Central Finding Routing6 of 6 scopes
Partial mapping · high confidence
What it is
Findings from every source are routed into one place with a named owner, instead of staying in the tool that produced them.
Why it matters
Findings that stay in the tool that produced them are seen only by whoever opens that tool, and nobody can say what the whole backlog is.
Why it maps PW.7.2 requires discovered issues to be recorded and triaged in the development team's workflow, not left in the tool that found them.
Covered everywhere your profile required it.

Your profile never required these

The catalog maps them to this requirement; your baseline did not ask for them. They are listed, not scored — nothing was demanded of them, so nothing about them has failed.

Insecure Implementation Pattern Detectionnot required
Partial mapping · medium confidence
Why it maps PW.7.2 measures the review against the secure coding standards, which is what a pattern rule set encodes.

Supporting only, never counted

A control that merely helps cannot be the reason something is called satisfied. Listed so you can see the whole picture, never counted.

SAST Feedback in the IDEnot required
Supporting · high confidence
Why it maps Analysis of human-readable code as PW.7 describes, but pre-commit findings never enter the issue tracking PW.7.2 also asks for.
Secret Findings Break the Buildnot required
Supporting · medium confidence
Why it maps Enforces the result of the analysis rather than performing it.