BSIMM is a compliance framework from International with 4 domains and 36 controls that map to 1 other frameworks. The largest domains are BSIMM Deployment (Penetration Testing, Software Environment, Config & Vulnerability Management) (10 controls), BSIMM Governance (Strategy & Metrics, Compliance & Policy, Training) (9 controls), BSIMM SSDL Touchpoints (Architecture Analysis, Code Review, Security Testing) (9 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
BSIMM Deployment (Penetration Testing, Software Environment, Config & Vulnerability Management)
| Code | Title |
|---|---|
| CMVM1.1 | Create or use an incident response capability for software |
| CMVM1.2 | Identify software defects found in operations and feed them back to development |
| CMVM1.3 | Track software bugs found in operations through the fix process |
| CMVM3.4 | Operate a bug bounty program |
| PT1.1 | Use external penetration testers |
| PT1.2 | Feed penetration test results to defect management |
| PT1.3 | Use penetration testing tools internally |
| SE1.2 | Ensure host and network security basics are in place |
| SE1.3 | Implement cloud security controls |
| SE3.6 | Enhance application inventory with an operations bill of materials |
BSIMM Governance (Strategy & Metrics, Compliance & Policy, Training)
| Code | Title |
|---|---|
| CP1.1 | Unify regulatory pressures |
| CP1.2 | Identify privacy (PII) obligations |
| CP1.3 | Create software security policy |
| SM1.1 | Publish process and evolve as necessary |
| SM1.3 | Educate executives on software security |
| SM1.4 | Implement security checkpoints and associated governance gates |
| SM2.2 | Enforce gates with measurements and track exceptions |
| T1.1 | Conduct software security awareness training |
| T1.7 | Deliver on-demand individual training |
BSIMM Intelligence (Attack Models, Security Features & Design, Standards & Requirements)
| Code | Title |
|---|---|
| AM1.2 | Create a data classification scheme and inventory |
| AM1.3 | Identify potential attackers |
| AM1.5 | Gather and use attack intelligence |
| SFD1.1 | Build and publish security features |
| SFD1.2 | Engage architecture teams with security |
| SR1.1 | Create security standards |
| SR1.3 | Translate compliance constraints to requirements |
| SR1.5 | Identify open source and manage its risk |
BSIMM SSDL Touchpoints (Architecture Analysis, Code Review, Security Testing)
| Code | Title |
|---|---|
| AA1.1 | Perform security feature review |
| AA1.4 | Use a risk-ranking methodology for applications |
| AA2.1 | Perform architecture analysis using STRIDE or equivalent |
| CR1.2 | Perform opportunistic code review |
| CR1.4 | Use automated code review tools (SAST) |
| CR1.5 | Make code review mandatory for all projects |
| ST1.1 | Perform edge/boundary value condition testing |
| ST1.3 | Drive tests with security requirements and features |
| ST1.4 | Integrate opportunistic security testing into the pipeline |
Maps to 1 other framework
What is BSIMM and who does it apply to?
BSIMM is a compliance framework from International with 4 domains and 36 controls. Building Security In Maturity Model It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does BSIMM actually require?
BSIMM has 36 controls organised across 4 domains. The largest domains are BSIMM Deployment (Penetration Testing, Software Environment, Config & Vulnerability Management) (10 controls), BSIMM Governance (Strategy & Metrics, Compliance & Policy, Training) (9 controls), BSIMM SSDL Touchpoints (Architecture Analysis, Code Review, Security Testing) (9 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of BSIMM do I already cover?
BSIMM maps to 1 other compliance frameworks. The top mapping partners are NIST SP 800-218 (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement BSIMM?
Start your BSIMM compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about BSIMM requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 36 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required