AI
Why Security Standards Need Mappings
Mappings describe relationships between concepts in different security standards. They translate requirements from one framework into another so organizations can understand how guidelines and regulations overlap. Abstraction level matters: mapping an apple to an apple tree creates mismatches. Direction matters too. Mappings can be unidirectional or bidirectional, and exhaustiveness is not always the goal. When domains differ too much or relationships are too loose, mapping those connections adds noise rather than value.
How OpenCRE Connects Standards Transitively
OpenCRE, an OWASP project, acts as a hub that all other standards map to. SAMM, NIST SSDF, CWE, and others each connect to OpenCRE bidirectionally. That bidirectionality is the key: if SAMM maps to OpenCRE and OWASP ASVS also maps to OpenCRE, then SAMM gets a transitive path to ASVS without anyone building that link directly. Raichev demonstrated an experiment at Codific where they extended this further by mapping an unsupported framework to an existing OpenCRE-connected standard first.
Compounding Errors in Transitive Paths
Every mapping has imperfections. When two imperfect mappings chain together in a transitive path, those errors multiply. Add a third hop and the result degrades further. Raichev showed this visually: the output of a double-transitive path looked notably worse than either source mapping alone. The SAMM team worked directly with the OpenCRE team to refine the SAMM-to-OpenCRE mapping, a fix not yet live at the time of the talk. Getting NIST to improve the SSDF-to-OpenCRE side would compound those gains.
Benchmarking OpenCRE Against an Official Mapping
The OWASP SAMM-to-NIST SSDF mapping received official NIST endorsement. Raichev used it as a benchmark, comparing it against the mapping OpenCRE generates transitively. He measured two values: the percentage of official relationships captured by OpenCRE, and the percentage of OpenCRE relationships that had no counterpart in the official version (noise). The noise figures, broken down by SAMM business function, were the bigger concern. The refined SAMM-to-OpenCRE mapping was not yet live, so he expects those numbers to improve.
The Maturity Score Problem
SAMM scores each activity from 0 to 3. SSDF answers each requirement with yes or no. No defined cutoff converts one into the other. An activity scored 2 might satisfy three sub-activities, but the one sub-activity relevant to an SSDF requirement could be the one scored 0. Raichev’s practical recommendation: document evidence during SAMM assessments, not just scores. With evidence on hand, a practitioner can manually check whether specific evidence satisfies the target SSDF requirement rather than inferring from aggregate numbers.
Q&A
Has OpenCRE mapping gained traction with corporations using multiple frameworks for internal assessments? Corporations are not publicly disclosing what they do, so community-shared data is essentially absent. ▶ Watch (27:30)
Are there plans for a community forum where organizations can share real-world mapping experiences? No such forum exists yet, but Raichev suggested the idea could be raised with the OpenCRE team, and said organizing one would be fast if a corporation offered to share data. ▶ Watch (29:13)
Notable Quotes
I truly believe openc will become the Cornerstone of our move from the current state of one million segregated and isolated standards to a communicative Network where standards can exchange ideas and improve together Dimitar Raichev · ▶ Watch (15:46)
we don’t really know if we’re getting garbage or we’re getting gold Dimitar Raichev · ▶ Watch (21:44)
I would also like to know uh but corporations aren’t actually running uh he over toe to tell everyone what they’re doing and that’s a big issue people are doing things but they’re not really sharing Dimitar Raichev · ▶ Watch (28:35)
Key Takeaways
- OpenCRE’s transitive mapping only works as well as the two underlying mappings feeding it.
- The SAMM 0-to-3 maturity scale has no defined cutoff for translating into SSDF yes/no answers.
- Evidence documentation during SAMM assessments makes framework translation manually verifiable where scores alone cannot.
About the Speaker(s)
Dimitar Raichev is a software security engineer at Codific, where he designs and develops SAMMY, a management tool supporting frameworks including SAMM, SSDF, CSF, and multiple ISO standards. His work on SAMMY drew him into framework mapping, and he has been an OWASP contributor since 2021, with growing involvement across OWASP and non-OWASP standards projects including NIST.