Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A new analysis examines how Russian companies can evaluate the maturity of their secure development processes without hiring external auditors. The article compares four methodologies: BSIMM, DSOMM, OWASP SAMM and the Russian national standard GOST R 56939-2024.
The study was conducted by simulating an internal audit on a fictional company, ООО «Лиса и лосЬ», which develops custom CRM systems using GitLab, Nexus and SonarQube. The company already has a secure development regulation based on the older GOST R 56939-2016 but lacks training, penetration testing and WAF protection.
BSIMM is described as a descriptive model that allows comparison with 121 organizations from the latest report published by Black Duck. DSOMM focuses on technical DevSecOps practices across five domains. OWASP SAMM provides an official Excel assessment tool and supports target maturity scoring from 0 to 3. GOST R 56939-2024 defines 25 processes with mandatory artifacts for verification.
The methodologies were scored across five criteria with a maximum total of 47 points. GOST R 56939-2024 scored 35 points while SAMM scored 34. BSIMM and DSOMM received lower scores of 22 and 25 respectively. The article notes that GOST R 56939-2024 is best suited for regulatory preparation, while SAMM excels at building flexible roadmaps.
The author emphasizes that commercial methodologies were excluded from the comparison to maintain objectivity. The series will continue with detailed walkthroughs of each methodology applied to the same fictional company profile.
Related articles
GlobalSign Launches New Wave of SSL/TLS Certificate Revocations Targeting Russian Organizations
GlobalSign has initiated another round of revocations affecting SSL/TLS certificates issued to Russian websites, with a total of 11,000 certificates withdrawn from 1,300 organizations so far. The revocations primarily impact entities listed in EU and US sanctions regimes, in line with updated CA/Browser Forum requirements that took effect in May 2026. Greek CA HARICA has also participated in the revocations, sometimes completing the process within seconds and leaving site owners little time to respond. The actions stem from mandatory checks against the OFAC SDN List, BIS Denied Persons List, and equivalent European sanctions databases. Russian authorities recommend obtaining domestic TLS certificates via Gosuslugi within three business days to maintain secure access in foreign browsers. Let's Encrypt has similarly updated its policies to restrict certificates for sanctioned Russian entities while continuing issuance for others.
Kaspersky Container Security Earns FSTEC Russia Certification as Antivirus Protection Tool
Kaspersky Container Security has received official certification from FSTEC Russia under certificate number 5122 dated October 23, 2026. The product was validated as a means of antivirus protection and meets the regulator’s requirements at the fourth level of trust. It also complies with the protection profile of type B for the fourth class, designated IT.SAVZ.B4.PZ. The certification enables deployment of the solution in government information systems, personal data processing environments, critical information infrastructure facilities, and industrial control systems. Specific usage must still align with individual system requirements and the conditions stated in the certificate. The solution has been listed in the Russian software registry maintained by the Ministry of Digital Development since 2023. Primary audiences include government agencies, large enterprises, and industrial operators that rely on containerized workloads inside regulated perimeters.
Russian Lawmaker Clarifies Apple and Microsoft ORI Registry Listing Does Not Ban Products
State Duma deputy Anton Nemkin stated that the inclusion of Apple and Microsoft in Russia's ORI registry imposes standard data retention obligations without automatically prohibiting their products. The registry entry requires companies to store user information and message exchange records in Russia for three years and message content for up to six months. Nemkin emphasized that these rules apply equally to Russian and foreign digital market participants regardless of business scale or country of registration. The companies were added on October 2, 2026, while Google Meet has been listed since January 26. Although the status mandates data provision to authorized bodies in legally defined cases, the listing itself does not confirm that corporations will share Russian users' correspondence with the state. Non-compliance may trigger separate regulatory measures, but the deputy urged against exaggerating consequences through sensational headlines.
Russia Hands Out 2.2 Million Rubles in Data Leak Fines During First Half of 2026
Russian companies received 13 fines totaling 2.195 million rubles for personal data leaks between January and June 2026, according to new research from InfoWatch. This amount represents a 1.6-fold increase compared to the entire previous year, when total fines reached only 1.385 million rubles. The study shows that Russian penalties accounted for roughly 11 percent of the 115 global fines recorded during the same period. Approximately one quarter of the Russian cases involved violations caused by employee negligence. Organizations in the IT and information security, industrial, and trade sectors were fined most frequently. InfoWatch notes that turnover-based fines have not yet been applied and expects broader enforcement to begin in 2027.