Updated Install and Readme docs and Usage and About Us pages #468

johnnyrenaissance · 2026-01-09T23:17:56Z

This change includes updates to the GitHub Install.md and Readme.md docs for updated usage as well as reformating so the information isn't in a single long page.

Also updated the About Us and Usage pages in the DSOMM app to be consistent with latest usage information. Seperated the usage and install instructions from the About Us page and kept them solely in the Usage page.

… the Docker instance

This reverts commit dd0aebb.

wurstbrot · 2026-01-10T09:21:40Z

src/assets/Markdown Files/README.md

-
-[![Timo Pagel IT-Consulting](https://raw.githubusercontent.com/DefectDojo/Documentation/master/doc/img/timo-pagel-logo.png)](https://pagel.pro)
-
-[![Apprio Inc](https://github.com/wurstbrot/DevSecOps-MaturityModel/raw/master-old/assets/images/Apiiro_black_logo.png)](https://apiiro.com/)


OWASP sponsors in the past donated money to a project with the benefit of getting listed. I am not sure at which time we are allowed to remove them. Therefore, they need to stay.
Heroku sponsored hosting once, now I am paying from my own money, so they can be removed.

Could we make a separate page for Supporters, and how to become a supporter, @wurstbrot?
(Such as https://owaspsamm.org/supporters/ and https://owaspsamm.org/sponsor/?)

EDIT: Nah. Thinking about it, I think they are better left under About us/README (as they were)

wurstbrot · 2026-01-10T09:32:17Z

To remind myself how the html will look like in the application:

wurstbrot

Hi @johnnyrenaissance ,
thank you for your valuable contributions.

Please let us know how you want to continue (e.g. you perform changes or we merge and I adjust).

I think we should remove duplicated content. As said, you can do that now or I do it afterwards.

wurstbrot · 2026-01-10T09:27:47Z

src/assets/Markdown Files/USAGE.md

+- How do we systematically improve security without slowing delivery?

-To do that, you need to install your own local DSOMM application.
+The model focuses on **concrete, technical activities** that integrate security directly into DevOps workflows such as CI/CD pipelines, containerization, infrastructure provisioning, and testing.


From my point of view DSOMM also offers process related activities like threat modeling. That could be mentioned in a sentence afterwards.

wurstbrot · 2026-01-10T09:36:47Z

src/assets/Markdown Files/USAGE.md

+- Written primarily by security specialists for security programs
+- Takes a broad, organization-wide perspective

+**DSOMM**:


-Easy to tailor

wurstbrot · 2026-01-10T09:38:21Z

src/assets/Markdown Files/USAGE.md

+**DSOMM**:
+- Focuses on embedding security directly into DevOps workflows
+- Operates lower in the technical stack (pipelines, containers, tooling)
+- Provides concrete implementation guidance for engineering teams


Provides overviews to guide technical management decisions

wurstbrot · 2026-01-10T09:46:44Z

src/assets/Markdown Files/USAGE.md

+
+For organizations that require evidence (e.g., for CISOs or auditors), DSOMM supports attaching evidence directly in YAML files.
+
+Evidence is defined in `generated.yaml` or `team-progress.yaml` files using the `teamsEvidence` attribute. Markdown is supported, and multi-line evidence can be provided using YAML block syntax.


we do not need to support old versions.
generated.yaml can be removed. correct @vbakke ?

I agree. We don't ned to support generated.yaml anymore. But we don't have a good solution for the evidence in v4 yet. I was three days delayed back from Amsterdam at New Years, so I've been flat out trying to catch up.

wurstbrot · 2026-01-10T09:49:36Z

INSTALL.md

@@ -1,103 +1,391 @@
-# Install DSOMM


we do not need to keep redundant parts.
E.g. Running DSOMM as a Docker Container (Recommended) or the SAMM overview

vbakke

Thank you @johnnyrenaissance! Here are some comments. But as you may have ben notified about, I have also started a top level discussion in the slack channel #dsomm.

I think if we can land the top level first, then it will be easer to move some of the information to the right place afterwards.

vbakke · 2026-01-17T11:39:49Z

src/assets/Markdown Files/README.md

-
-[![Timo Pagel IT-Consulting](https://raw.githubusercontent.com/DefectDojo/Documentation/master/doc/img/timo-pagel-logo.png)](https://pagel.pro)
-
-[![Apprio Inc](https://github.com/wurstbrot/DevSecOps-MaturityModel/raw/master-old/assets/images/Apiiro_black_logo.png)](https://apiiro.com/)


Could we make a separate page for Supporters, and how to become a supporter, @wurstbrot?
(Such as https://owaspsamm.org/supporters/ and https://owaspsamm.org/sponsor/?)

EDIT: Nah. Thinking about it, I think they are better left under About us/README (as they were)

vbakke · 2026-01-17T14:15:06Z

src/assets/Markdown Files/USAGE.md

+---
+
+### Evidence and Team-Specific Implementation
+


I think we should remove the evidence part, until we land how we are going to do the evidence part.

vbakke · 2026-01-17T14:29:48Z

src/assets/Markdown Files/USAGE.md

@@ -1,63 +1,417 @@
-# DSOMM - DevSecOps Maturity Model
+<details>


I really like that you have hidden all the content under expandable headings. It makes the total page look much less daunting. And easier to navigate.

But I suggest we lean the first section open, so the page is not just a list of headings:

<details> → <details open>

(And then we tailor this first section to suit the newcomers that have never seen this web site before.)

vbakke · 2026-01-17T14:33:54Z

src/assets/Markdown Files/USAGE.md


-## DSOMM vs OWASP SAMM
-[DSOMM](https://dsomm.owasp.org/) and [OWASP SAMM](https://owaspsamm.org/) are both frameworks that share a common goal of improving security. 
+DSOMM is an open project of the **OWASP Foundation**, developed to provide practical, implementation-focused guidance for modern DevOps environments.


With the new structure, I think we can move this sentence to the About us. And rather say a few brief sentences about using the DSOMM website.

Target audience: newcomers that have never seen this web site before.

And when we present it like this, I think we should have one very short paragraph in the section describing how to use DSOMM. For the first entry user, that has never seen the web site before.

Some ideas to the content of that paragraph.

DSOMM is organized in maturity levels. If you are new to DSOMM, start with familiarize yourself with the activities at level 1, which is in the inner circle. Play with the teams to group your applications or your people in a size that makes it easy to manage. When starting out it might be better to have fewer, rather than many and smaller, teams.

vbakke · 2026-01-17T14:40:50Z

src/assets/Markdown Files/USAGE.md

-## DSOMM vs OWASP SAMM
-[DSOMM](https://dsomm.owasp.org/) and [OWASP SAMM](https://owaspsamm.org/) are both frameworks that share a common goal of improving security. 
+DSOMM is an open project of the **OWASP Foundation**, developed to provide practical, implementation-focused guidance for modern DevOps environments.



I think we should add a wee note about data storage here in the initial section.

NB! The DSOMM website does not have a database and stores your changes in your local browser. To share your data, you need to run your own instance, and upload the files containing your teams and your progress.

vbakke · 2026-01-17T15:30:50Z

INSTALL.md

@@ -1,103 +1,391 @@
-# Install DSOMM
-The DSOMM application is frontend only. Data is only stored in server side YAML files, and in the localStorage im the user's browser. 
+<details>


The INSTALL.md is currently not shown as a webpage, thus making summary makes less sense. (Unless we move it to /assets/ of course. : )

johnnyrenaissance added 7 commits January 8, 2026 11:23

Updated instructions on loading custom settings and status files into…

afb74d5

… the Docker instance

Updated About, Readme, and Usage language

9820e32

Updated README formatting

dd0aebb

Revert "Updated README formatting"

829506a

This reverts commit dd0aebb.

More readme updates

1bc175c

Final readme updates

356aa1b

Ok, let's stop this nonsense

03e2c30

johnnyrenaissance marked this pull request as draft January 9, 2026 23:18

johnnyrenaissance closed this Jan 9, 2026

johnnyrenaissance reopened this Jan 9, 2026

johnnyrenaissance marked this pull request as ready for review January 9, 2026 23:20

wurstbrot reviewed Jan 10, 2026

View reviewed changes

wurstbrot requested changes Jan 10, 2026

View reviewed changes

wurstbrot requested a review from vbakke January 10, 2026 09:52

vbakke reviewed Jan 17, 2026

View reviewed changes


		[![Timo Pagel IT-Consulting](https://raw.githubusercontent.com/DefectDojo/Documentation/master/doc/img/timo-pagel-logo.png)](https://pagel.pro)

		[![Apprio Inc](https://github.com/wurstbrot/DevSecOps-MaturityModel/raw/master-old/assets/images/Apiiro_black_logo.png)](https://apiiro.com/)


		For organizations that require evidence (e.g., for CISOs or auditors), DSOMM supports attaching evidence directly in YAML files.

		Evidence is defined in `generated.yaml` or `team-progress.yaml` files using the `teamsEvidence` attribute. Markdown is supported, and multi-line evidence can be provided using YAML block syntax.

		@@ -1,63 +1,417 @@
		# DSOMM - DevSecOps Maturity Model
		<details>

Uh oh!

Updated Install and Readme docs and Usage and About Us pages #468

Are you sure you want to change the base?

Updated Install and Readme docs and Usage and About Us pages #468

Conversation

johnnyrenaissance commented Jan 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vbakke Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wurstbrot commented Jan 10, 2026

Uh oh!

wurstbrot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vbakke left a comment

Choose a reason for hiding this comment

Uh oh!

vbakke Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vbakke Jan 17, 2026 •

edited

Loading

vbakke Jan 17, 2026 •

edited

Loading