Security-gap assessment method
A per-product assessment run during STOP, producing a scored security-debt register and a maturity snapshot with targets. The security half of "make the base stable before agents touch it."
The method
- OWASP ASVS assessment — Level 2 target for insurance data. Per-control pass/fail with evidence.
- SAMM-lite maturity snapshot — where the product sits across the OWASP SAMM practices, with 6- and 12-month targets.
- SBOM + SCA — a CycloneDX SBOM per product, scanned for known CVEs; a defensible answer to "what are we actually running?"
- Findings scored — CVSS + EPSS (exploit likelihood) + business exposure, so a theoretically-critical-but-unreachable issue doesn't outrank a live one.
Fix-by SLAs
| Severity | Fix by |
|---|---|
| Critical | days |
| High | weeks |
| Medium | next remediation cycle |
| Low | backlog |
Output
The security-debt register, the SBOM baseline, and the maturity targets. Anything consciously not fixed exits only via a risk-acceptance record.
Standards referenced: OWASP ASVS, OWASP SAMM, CycloneDX, SLSA.