OWASP ASVS: A Standard for Application Security Verification
Most teams know the OWASP Top 10. Fewer use its more powerful sibling: the Application Security Verification Standard (ASVS). Where the Top 10 lists the biggest risks, ASVS gives you a comprehensive, testable checklist of security requirements for building and verifying applications.
What ASVS is
ASVS is an open standard of detailed, verifiable security requirements grouped by area — authentication, session management, access control, validation, cryptography, error handling, logging, and more. Each requirement is written so you can test for it, which makes ASVS equally useful as a design checklist, a code-review guide, and a pen-test scope.
Three assurance levels
| Level | For |
|---|---|
| Level 1 — Opportunistic | All applications; basic, fully testable from the outside |
| Level 2 — Standard | Apps handling sensitive data — the recommended target for most |
| Level 3 — Advanced | High-value / high-assurance apps (payments, health, critical systems) |
Why use it
It’s testable, not aspirational
Each requirement maps to a check, so “secure” becomes measurable rather than a vibe.
It scales with risk
Pick the level that matches the app — don’t gold-plate a brochure site or under-protect a payments app.
It’s procurement-friendly
Specifying “ASVS Level 2” in contracts gives vendors a concrete, shared bar.
Getting started
- Choose a target level per application based on the data it handles.
- Use the requirements as a design and code-review checklist, not just a final test.
- Track which requirements are met, in progress, or not applicable.
- Feed ASVS into your pen-test scope so testing is comprehensive, not ad-hoc.
- Map ASVS coverage to ISO 27001 and SOC 2 so app-security work counts toward compliance.
The bottom line
The OWASP Top 10 tells you what to fear; ASVS tells you what to build and how to verify it. Adopt a target level, use it across design, review and testing, and you turn application security from a checklist of dread into a measurable engineering standard.
Track ASVS alongside your frameworks
Cyber Horizon supports OWASP ASVS as one of 72 frameworks — map requirements to controls and evidence, and roll it up to ISO 27001 and SOC 2.
Book a Demo