OWASP SAMM

1. Strategy and Metrics

   Security strategy, maturity targets and measuring program effectiveness.

2. Policy and Compliance

   Policies, standards and compliance requirements for software.

3. Education and Guidance

   Developer security training and guidance.

4. Threat Assessment

   Application risk profiles and threat modeling.

5. Security Requirements

   Software and supplier security requirements.

6. Security Architecture

   Secure design principles and technology management.

7. Secure Build

   Build process, software dependencies and reproducibility.

8. Secure Deployment

   Deployment process, secret management and release integrity.

9. Defect Management

   Defect tracking, metrics and vulnerability remediation.

10. Architecture Assessment

    Architecture validation and mitigation of threats.

11. Requirements-driven Testing

    Control verification and misuse/abuse testing.

12. Security Testing

    Scalable baseline and deep-understanding security testing.

13. Incident Management

    Incident detection, response and handling.

14. Environment Management

    Configuration hardening and patching and updating.

15. Operational Management

    Data protection and system decommissioning.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.