OWASP Application Security Verification Standard (ASVS)

What it is

ASVS is OWASP's Application Security Verification Standard, a structured list of security requirements for web applications and services, organised into chapters covering areas such as authentication, session management, access control, input validation, cryptography, error handling, API security and configuration. As of 2026-09 the current stable release is version 5.0.0, dated May 2025, with 345 requirements across 17 chapters. It is published under the Creative Commons Attribution-ShareAlike 4.0 licence and free to download from the official project page and GitHub in PDF, Word and CSV formats.

What it is for

Two common uses stand out. First, as a set of requirements a team agrees to build against from the start, so security expectations are explicit rather than left to individual judgement. Second, as a checklist for reviewing an existing application, either self-assessed or as the basis for a third-party audit, with each requirement mapped to one of three increasingly strict verification levels.

Verification levels

ASVS defines three levels of increasing rigour: level 1 covers requirements that should apply to essentially every application and can often be checked with automated tooling, level 2 is the recommended baseline for applications handling sensitive data, and level 3 is aimed at applications where the highest level of trust is required, such as those handling critical transactions.

How to use it

Read the chapter structure first to see how it maps onto areas your application already touches, then pick a target level appropriate to what the application handles. Use it alongside a checklist tracker or spreadsheet to record which requirements are met, partially met or not applicable, since not every requirement applies to every application.

Free versus paid

ASVS itself is completely free to read, download and use, with no paid tier. Some third-party consultancies sell ASVS-based audit services or tooling, but the standard itself carries no cost.

Prerequisites

Some familiarity with web application architecture makes the requirements easier to interpret; ASVS assumes you already understand roughly how the application you are assessing is built, rather than teaching those concepts itself.

Common questions

Is ASVS the same as the OWASP Top Ten? No, the Top Ten is a short, prioritised list of the most common risk categories aimed at raising awareness; ASVS is a much longer, detailed set of testable requirements aimed at verification.

Do I need to satisfy every requirement? No, requirements are scoped by verification level and by relevance to what the application actually does.

Does it cover mobile applications? No, OWASP maintains a separate standard and testing guide specifically for mobile.