OWASP Product Security Capability Framework
OWASP Product Security Capability Framework - An OWASP incubator project
This is the OWASP framework for building security capabilities into your product delivery process and teams.
The main website for the PSCF is on Prodsec and includes many more details about the Framework along with explanatory videos.
We created the Product Security Capability Framework to provide a clear way of thinking about software product security and the delivery activities that lead to building and maintaining the right level of security for your customers and your organisation.
This framework is designed to be the foundation of:
The framework currently consists of six (6) process areas and thirty-two (32) capabilities.
The current 1.0 version of the framework is available here in Google Sheets and anyone with can comment and contribute there.
The Sheet allows someone to do an assessment of their own organisation’s capabilities and get a report.
The full text and multimedia site is available on Prodsec
Project Resources
Project Information
Incubator Project
Classification
Other
License
Creative Commons Attribution Share Alike 4.0 International
Contributors
4
GitHub Stars
29
Downloads
0
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.