search

owaspsamm / website

The OWASP SAMM Website
https://owaspsamm.org
9 stars 12 forks source link

Guidance on score reporting #236

Open aramhovsepyan opened 5 months ago

aramhovsepyan commented 5 months ago

Create guidance on reporting the scoring to the management / executive board. Blogpost should focus on the whole N/A and how to report scores towards the executive board.

Impact is high on this issue as many users are still struggling to figure out the "Not applicable" issue. Urgency: high.

SebaDele commented 2 days ago

there is already a blogpost on N/A https://owaspsamm.org/blog/2023/02/28/the-not-applicable-question/ This also includes the target / percentage to complete ...

johndileo commented 2 days ago

Basic Formula:

(a) Progress to date = (Current Score - Baseline Score) / (Target Score - Baseline Score), if Target Score <> Baseline Score

(b) Progress to date = 1.0 (100%), if Target Score == Baseline Score

Value of "Progress to date" is in the range 0.0 - 1.0 (0 - 100%)

aramhovsepyan commented 2 days ago

Here is the formula I have in mind:

GapQ = Target Score - Current Score (if GapQ < 0, GapQ = 0) (per activity). GapSum = SUM(GapQ) TargetSum = SUM(TargetScore) PercentageToTarget = 1-GapSum/TargetSum;