the use of "Regular" and "Annual" within the answer sections of SAMM2.0 about samm HOT 1 CLOSED

this was discussed within the core team, here are some notes:

to explain the use of the 2 time frequencies:
"annually" was used with things that are more likely to be related to compliance that would have an annual requirement. "regularly" would be more used for something that we are not trying to dictate a timeframe, but needs to be done not just once.

We used "annual" in practices where it would have more weight that "regularly".
E.g. in stream A "Create and Promote" of security practice "Strategy & Metrics" we assume that at least an annual review will be more frequent and a stronger requirement than a regular review which is probably every couple of years.
Keep that in mind when reviewing and scoring your maturity.

We will keep this issue open for adding these clarifications in locations where these terms are used. And will consider to be more precise in time frequencies in the scoring mechanism.

from samm.