Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
BSIMM Deployment (Penetration Testing, Software Environment, Config & Vulnerability Management)
| Code | Title |
|---|---|
| CMVM1.1 | Create or use an incident response capability for software |
| CMVM1.2 | Identify software defects found in operations and feed them back to development |
| CMVM1.3 | Track software bugs found in operations through the fix process |
| CMVM3.4 | Operate a bug bounty program |
| PT1.1 | Use external penetration testers |
| PT1.2 | Feed penetration test results to defect management |
| PT1.3 | Use penetration testing tools internally |
| SE1.2 | Ensure host and network security basics are in place |
| SE1.3 | Implement cloud security controls |
| SE3.6 | Enhance application inventory with an operations bill of materials |
BSIMM Governance (Strategy & Metrics, Compliance & Policy, Training)
| Code | Title |
|---|---|
| CP1.1 | Unify regulatory pressures |
| CP1.2 | Identify privacy (PII) obligations |
| CP1.3 | Create software security policy |
| SM1.1 | Publish process and evolve as necessary |
| SM1.3 | Educate executives on software security |
| SM1.4 | Implement security checkpoints and associated governance gates |
| SM2.2 | Enforce gates with measurements and track exceptions |
| T1.1 | Conduct software security awareness training |
| T1.7 | Deliver on-demand individual training |
BSIMM Intelligence (Attack Models, Security Features & Design, Standards & Requirements)
| Code | Title |
|---|---|
| AM1.2 | Create a data classification scheme and inventory |
| AM1.3 | Identify potential attackers |
| AM1.5 | Gather and use attack intelligence |
| SFD1.1 | Build and publish security features |
| SFD1.2 | Engage architecture teams with security |
| SR1.1 | Create security standards |
| SR1.3 | Translate compliance constraints to requirements |
| SR1.5 | Identify open source and manage its risk |
BSIMM SSDL Touchpoints (Architecture Analysis, Code Review, Security Testing)
| Code | Title |
|---|---|
| AA1.1 | Perform security feature review |
| AA1.4 | Use a risk-ranking methodology for applications |
| AA2.1 | Perform architecture analysis using STRIDE or equivalent |
| CR1.2 | Perform opportunistic code review |
| CR1.4 | Use automated code review tools (SAST) |
| CR1.5 | Make code review mandatory for all projects |
| ST1.1 | Perform edge/boundary value condition testing |
| ST1.3 | Drive tests with security requirements and features |
| ST1.4 | Integrate opportunistic security testing into the pipeline |
Maps to 1 other framework
Frequently Asked Questions
What is BSIMM?
BSIMM is a compliance framework from International with 4 domains and 36 controls. Building Security In Maturity Model It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does BSIMM have?
BSIMM has 36 controls organised across 4 domains. The largest domains are BSIMM Deployment (Penetration Testing, Software Environment, Config & Vulnerability Management) (10 controls), BSIMM Governance (Strategy & Metrics, Compliance & Policy, Training) (9 controls), BSIMM SSDL Touchpoints (Architecture Analysis, Code Review, Security Testing) (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does BSIMM map to?
BSIMM maps to 1 other compliance frameworks. The top mapping partners are NIST SP 800-218 (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with BSIMM compliance?
Start your BSIMM compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about BSIMM requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 36 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.
Get Started Free →Free forever — no credit card required