W3SAMM

Leadership and Organizational Principles

Control Criteria

A team or individual is available to drive the security program
Level 1: Is there an initial awareness and understanding of security culture within the organization?
Level 2: Are structured programs in place for promoting and reinforcing a strong security culture?
Level 3: Is there a pervasive, deeply ingrained security culture, actively supported and enhanced by all team members?

Control Criteria

A formal reference for security vision or mission statement exists for the organization/project
Organizational or project goals are clearly defined
Stakeholders for security decisions are defined
Level 1: Is the security vision clearly defined and communicated within the organization?
Level 2: Is the security vision integrated into broader organizational goals and regularly reinforced through communication?
Level 3: Is there ongoing, dynamic communication about the security vision, including feedback loops with various stakeholders?

Control Criteria

The organizational structure considers the challenges of distributed teams such as timezones, equipment, events, and physical access to technology
Staff and personnel are clearly delineated from contributors
Input from a greater ecosystem or community is considered in developing organizational structure
Partnerships and related organizations are clearly defined
Level 1: Is there a basic structure in place that supports Web3 security needs?
Level 2: Does the organizational structure adapt to evolving Web3 security challenges and integrate cross-functional teams?
Level 3: Is the structure highly adaptive, promoting agility and rapid response to Web3 security trends and threats?

Control Criteria

Clear documentation of security roles/responsibilities
Regular updates and communication about role changes and security updates
Established channels for udpates and feedback
Level 1: Are basic roles and responsibilities for security defined within the organization?
Level 2: Are roles and responsibilities for security clearly detailed, communicated, and understood across the organization?
Level 3: Is there a high level of role clarity, with ongoing refinement and alignment of responsibilities as the organization evolves?

Metrics are defined for tracking security and security activities
Systems exist to track security metrics and objectives
There is a regular review of collected data
Level 1: Are basic performance metrics for security established and tracked?
Level 2: Are these metrics regularly reviewed and used to guide decision-making?
Level 3: Are there advanced, comprehensive metrics in place, covering diverse aspects of security, and regularly used for strategic planning?

A roadmap for security exists alongside the security strategy
The roadmap is objectively measurable
Stakeholders have approved or agreed to the roadmap for security
Level 1: Are there initial efforts to identify and implement security improvement initiatives?
Level 2: Is there a structured process for regularly initiating, tracking, and reviewing improvement projects?
Level 3: Is there an established culture of continuous improvement, with initiatives systematically integrated and aligned with organizational learning?

This site is open source. Improve this page.