OWASP ASVS

What it means

The Application Security Verification Standard, or ASVS, is an OWASP project. It is a numbered list of security requirements for web applications and APIs, grouped by topic such as authentication, session management, access control and data protection. It is free to use.

It is written as statements you can check, for example whether the app enforces access rules on the server. It defines three levels of rigour, so a team can choose the one that fits its risk. Level 1 is the baseline and level 3 is for the most sensitive systems.

Why it matters

Most people know the OWASP Top 10, which names broad risk categories. ASVS goes further. It tells you what to build and what to test, in enough detail that a developer, a buyer and a tester can all point at the same line.

That shared reference saves arguments. A buyer can ask for a given level. A tester can report against numbered items. You can show progress over time, and you avoid inventing your own checklist that nobody outside the company recognises. It also helps new developers learn what good looks like.

How it shows up

Teams use it in three ways: as a source of security requirements for new features, as a scope for a pentest, and as a checklist for self-assessment. Most business applications aim for level 2. Level 1 suits low-risk apps, and level 3 suits high-value systems such as those handling large financial or health data.

The mistakes repeat. A team declares a level without checking it, or tries to meet every item at once and gives up. Start with the chapters nearest your risk, such as access control and authentication. Treat each unmet item as work to schedule, and track it like any other security debt.