Key Facts
- Regulator
- OWASP Foundation (ASVS flagship project)
- Latest version
- ASVS 5.0.0
- Effective
- 30 May 2025
- Official text
- owasp.org ↗
What is OWASP ASVS?
OWASP ASVS, the Application Security Verification Standard, is a list of security requirements for web applications, published by the OWASP Foundation as a flagship OWASP project. Developers use it as a requirements list for secure development and testers use it as a basis for testing technical security controls. It applies to any team building or testing web applications.
OWASP describes the Application Security Verification Standard as a basis for testing web application technical security controls, and as a list of requirements for secure development. It tests the controls the application relies on, such as protection against cross-site scripting (XSS) and SQL injection, and can be used to establish confidence in the security of a web application.
The latest stable version is ASVS 5.0.0, released in May 2025. The standard sorts its requirements into three verification levels, so a team can say how far it has verified an application, not just that it has. The OWASP ASVS levels are set out under Key requirements.
Why it matters
A customer asks whether your application has been verified against OWASP ASVS Level 2. Your last penetration test report says it was tested for "common vulnerabilities". Those are two different claims, and the deal waits on the gap between them.
ASVS gives that conversation a named yardstick. It tells developers what to build, tells testers what to check and lets a buyer read a result without guessing at the scope.
A penetration test with no stated standard tests whatever the tester chose to test.
Who it applies to
OWASP ASVS is written for people who build, test or commission web applications. Developers use it as a requirements list. Security testers and assessors use it as the basis for a test scheme. Buyers can name it as the standard a supplier's application is verified against.
It is a community standard published by a foundation, not a statute or a regulator's rule. We found no source that makes it mandatory. Treat it as a requirement only where a customer, tender or contract names it, and read what level and version they mean.
ASVS sits beside ISO 27001 rather than inside it. ISO 27001 asks you to run secure development as part of your management system (the nearest control is A.8.25 Secure development life cycle). ASVS supplies the application-level list of what "secure" means when you test the result. See the ISO 27001 vault for the management system side.
The UK position
No UK regime in the sources we checked names OWASP ASVS. A UK firm meets it commercially: when a customer's security review, a tender or a penetration test scope names an ASVS level as the target for a web application. Outside those requests, a UK firm can adopt it voluntarily as its secure-development baseline.
Key requirements
ASVS is a verification standard, so its substance is a structured list of requirements and the levels that decide which of them apply.
Structure
Version 4.0.3 contained 286 verification requirements, agreed by a wide security community. They are split into chapters V1 to V14, which include:
- Authentication
- Session Management
- Access Control
- Stored Cryptography
- Data Protection
- API and Web Service
- Configuration
Version 5.0.0 reorganised the chapters. Chapter numbers therefore differ between versions, so check which version a customer or tester means before you quote a requirement number.
The three levels
The OWASP Developer Guide describes three levels of security verification, against version 4.0.3:
- Level 1 is for first steps and automated testing.
- Level 2 is for most applications.
- Level 3 is for high-value, high-assurance or high-safety applications, such as those that perform high-value transactions or hold sensitive medical data.
Most applications aim for Level 2.
A level you haven't chosen is a level you haven't met.
Using ASVS as a checklist
The OWASP ASVS checklist is the requirements list itself: each requirement is a statement a tester can mark as met or not met for a given application and level. Two OWASP resources make it easier to work with:
- The OWASP Cheat Sheet Series is indexed to each section of ASVS, which helps you decide which requirement categories to include in a test scheme.
- Tools such as OWASP SecurityRAT can help derive a more manageable subset of ASVS requirements for a given application.
The OWASP Developer Guide covers ASVS in its requirements section.
Frequently asked questions
OWASP ASVS is the Application Security Verification Standard, an open standard from the OWASP Foundation that sets the coverage and rigour expected when verifying a web application's security. Earlier versions date from 2008, and OWASP has maintained it since. OWASP ASVS is free to use under a Creative Commons Attribution-ShareAlike 4.0 licence and is published in formats including PDF, CSV and JSON.
OWASP publishes the OWASP ASVS requirement lists in CSV, JSON and other formats, which makes it straightforward to turn the standard into a working checklist. Load the list into a spreadsheet or tracker, keep the requirements for your chosen level, and record each one as met, not met or not applicable for the application under test.
OWASP ASVS has three levels of verification. In the OWASP Developer Guide's description of version 4.0.3, Level 1 is for applications that need only low assurance, and it is the only level described as completely penetration testable. Level 2 is for applications holding sensitive data and is recommended for most. Level 3 is for the most critical applications, which need the highest level of trust.
No law or regulator we found makes OWASP ASVS mandatory. OWASP's stated aim is a commercially workable open standard that evens out the coverage and rigour of web application security verification across the market, and its resources are free to use. OWASP ASVS binds a firm only when a customer, tender or contract names it.
No. ISO 27001 does not name OWASP ASVS, and an ISO 27001 certificate says nothing about the ASVS level an application meets, because the certification audit covers the management system, not each application. A firm with both can use its OWASP ASVS results as evidence that its secure development control (A.8.25) works in practice.
Use the version your customer, tender or tester names. OWASP lists 5.0.0 as the latest stable release of OWASP ASVS, and requirement identifiers change between versions. OWASP therefore recommends citing a requirement with its version tag, such as v5.0.0-1.2.5, so that a test report or contract points to exactly one requirement.