## 2 Background  
According to [22], the software development life cycle (SDLC) is defined as a set of phases that software must go through from the moment a need arises, passing through the phases of development and operation. Software engineering implements a series of \"models\" that divide the project into stages from its initial conception, development, testing, release, and maintenance. For each stage, standards are created those guide engineers, guiding the work of the different phases in technical activities and, thus, providing a formal framework for management, development progress, maintenance, and resource estimation. Developing secure and reliable software also requires adopting a systematic process or discipline that addresses security in each of the phases of the software life cycle. Some software development models integrate security activities such as specific design principles and security practices. * Secure Software Development Life Cycle (S-SDLC), this model is based on verifying security requirements throughout the different phases of software construction [23; 24]. The advantage of adopting an S-SDLC approach is the identification of coding and design errors in the early stages of development [24]. The research paper by [PERSON] [23] proposes a new Secure Software Development Life Cycle (S-SDLC) that addresses security issues in software development. The S-SDLC includes six phases: requirements, design, implementation, testing, deployment, and maintenance, and integrates specific security activities into each phase. The author emphasizes the importance of incorporating security early in the SDLC process, beginning with the requirements phase. Developing security requirements is derived from business requirements and security policies to achieve this. During the design phase, the focus is on creating a secure software architecture that aligns with the security requirements. The implementation phase includes secure coding practices that aim to prevent security vulnerabilities. Security testing is carried out during the testing phase to identify and remedy security issues. The deployment phase involves secure deployment and configuration of the software to ensure the software remains secure. The maintenance phase focuses on ensuring the software continues to be secure through ongoing monitoring, vulnerability management, and incident response. The proposed S-SDLC provides a comprehensive approach to integrating security into the SDLC process to develop secure software from the outset. With S-SDLC, several additional security practices and activities can be enriched. These practices include a security specification language, a security requirements engineering process, a secure design specification language, a set of secure design guidelines, a secure design pattern, a secure coding standard, and a software security assurance method, which may comprise penetration testing, static analysis for security, and code reviews for security [23]. * Security Assurance Maturity Model (SAMM), the goal of the OWASP SAMM is to be the leading maturity model for software assurance that provides a practical and measurable way for all types of organizations to analyze and improve their software security posture [25]. This model supports the entire software lifecycle, including development and acquisition, and is independent of technology and processes. The Software Security Maturity Model (SAMM) is an open methodology that allows organizations to design and implement a strategy to improve software security [26]. This model addresses the specific software security risks faced by each organization. The Security Assurance Maturity Model (SAMM) is a framework designed to help organizations to improve their software security processes. SAMM has four domains: Governance, Construction, Verification, and Deployment. Each domain has three maturity levels, ranging from ad-hoc to optimized processes. The Governance domain covers policy and strategy, which provides direction and guidance for the security program.