SAMM Benchmark

[Pat-Duarte]

From September Core Team Call

Pre-meeting notes:

• Have infrastructure and data collection available publicly
• Have platform code available publicly
• Add metadata to the interview tab or have a dedicated benchmark tab in toolbox (Seba)

Feedback from legal review

• no interview notes (keep confidential info out of the dataset at all costs)
  Don’t import them
• explicit consent for upload (practitioner stating their clients gave them permission to upload)
• terms for researchers (stating they won't misuse the data)
• link clients to practitioners (only for core team to access)

Action items:

• write terms and conditions for submitters and researchers
• Update and publish page
• Have public code for benchmark under OWASP or SAMM
• Have a Database set up

[Pat-Duarte]

Based on the October team call, we've updated the benchmark page and uploaded Brian's demo video to youtube.

[Pat-Duarte]

Terms & conditions:

• Ask for OWASP legal team review
• Publish to DAVID

Email from practitioners to clients:

• Write an intro text for practitioners to understand what the template is about (help boostrapping benchmark by contributing datasets)
• Send email to practitioners from benchmark account

[Pat-Duarte]

Next step: activate practitioners

[SebaDele]

update - a mailing to the practitioner to contribute to the benchmark was sent on 8-Oct - we have an issue created to follow-up on this #89