What is the OWASP DevSecOps Maturity Model (DSOMM)?

An OWASP maturity model that groups DevSecOps practices into categories and maturity levels, so a team can see where its pipeline stands and what to add next.

DSOMM (dsomm.owasp.org) lists concrete activities, such as SCA in the build or signed artifacts, and sorts them into five categories:

• Build and deployment
• Culture and organisation
• Implementation
• Information gathering (logging, monitoring, metrics)
• Test and verification

Each activity sits at a maturity level, so the model works as a roadmap. A team rates itself, sees the gaps at its current level, and picks the next practices to adopt. Higher levels are not the goal in themselves. A small product may sensibly stop at a lower level, while a critical one needs more.

Go deeper:

• OWASP DSOMM — the interactive model: browse activities by dimension and level
• OWASP DevSecOps Maturity Model project — background and how to self-assess