A descriptive model that provides a baseline of observed software security initiatives and activities from a collection of volunteer software development shops.