OWASP ASVS
The Application Security Verification Standard used to design and review secure applications.
Where we use it
- Security requirements
- Pre-launch reviews
Strengths
- Structured, testable controls
Considerations
Trade-offs worth knowing before you choose it.
- Level selection depends on risk
OWASP ASVS is a trademark of its owner. Listing it describes work we offer and does not imply a partnership or certification.
Services that use OWASP ASVS
More in security
- OA
OAuth 2.0
The standard framework for delegated authorisation between applications.
- OI
OpenID Connect
Identity layer on OAuth 2.0 for single sign-on.
- SS
Single sign-on (SSO)
One login across applications via SAML or OIDC.
- MF
Multi-factor authentication
Second factors such as authenticator apps and security keys.
- RB
Role-based access control
Permissions grouped into roles and enforced server-side.
- En
Encryption
TLS in transit, encryption at rest and field-level encryption for sensitive data.
- WF
Web application firewall
Edge filtering of malicious HTTP traffic and bots.
- SM
Secrets management
Storing, rotating and auditing credentials outside code and images.
Have a OWASP ASVS project in mind?
New build, rescue or modernisation — share what you have and where you want to get to.