Summary
Ask a team whether it does DevSecOps and the answer is almost always yes; ask on which projects, since when and with what result, and the answer stops. The article argues for two instruments, because there are two questions. The OWASP DevSecOps Maturity Model (DSOMM) describes what teams know how to do: five dimensions, 19 sub-dimensions and about 190 activities on levels 1 to 5, shown as a circular heatmap. An activity counts only when evidence is attached: run with IS_IMPLEMENTED_WHEN_EVIDENCE, the model’s generator marks the activity as done for every team whose evidence is not empty, and warns when it is.
The article then describes the cycle, a method the author has applied several times, each time at a CIO’s request rather than from the teams: install the heatmap online or self-host it with Docker, declare teams and team groups in meta.yaml, collect data and evidence every week with the teams, generate generated.yaml, validate the assessment every month with the CIO, then publish the heatmap alongside the monthly indicators.
The dashboard has four axes (adoption and coverage, risk and vulnerabilities, responsiveness and quality, culture and governance), three indicators each, every indicator with a source and a target, read on one real month. Its lessons: a figure says little without its trend; keeping only the vulnerabilities with a documented exploit cut the cumulative stock from 217 to 97; a rising stock can mean better coverage; transitive dependencies without a fix call for a list of authorised components; tooling gaps are measured too. The executive summary gives each axis a traffic light, a trend, a risk and an action.
Key ideas
- A self-declared answer measures nothing; a maturity model only helps when every activity marked as done carries its evidence.
- OWASP DSOMM spreads about 190 activities over five dimensions, 19 sub-dimensions and five levels, and its generator turns non-empty evidence into a completed activity.
- The assessment starts from the CIO’s request, then runs in two loops: data and evidence collected every week with the teams, the result validated every month with the CIO before the heatmap is published.
- A monthly dashboard needs a source and a target for every indicator, and a trend beside every figure; whether an exploit is documented is a second prioritisation lever next to the CVSS score.
- Management reads a first page of four traffic lights, one per axis, each with a trend, a risk and an action.