Incidentally, BSIMM 7 (https://www.bsimm.com/download/) also came out this month. Whereas BSIMM is descriptive and OpenSAMM (http://www.opensamm.org/) is prescriptive, I'm curious to see how NIST tackles the secure development lifecycle.