Use OWASP ASVS to decide what a specific web application must do and how to verify it. Use OWASP SAMM to assess and improve how your organization builds software. One is a list of technical requirements. The other is a maturity model for a whole program.
What ASVS is
The OWASP project page describes the Application Security Verification Standard as a basis for testing web application technical security controls and as a list of requirements for secure development. It aims to standardize how thoroughly web application security is verified. The page lists 5.0.0 as the latest version.
That makes ASVS useful when you need a requirement set: for a new build, for a test plan, or for an internal baseline that developers can read. If you are given an ASVS version in a questionnaire, check which one, since the standard has been revised.
What SAMM is
OWASP describes SAMM, the Software Assurance Maturity Model, as an open, community driven framework for measuring and improving an organization's software security. It is self assessment based, technology agnostic and risk driven.
Its structure is regular:
- Five business functions.
- Fifteen security practices, three under each function.
- Two streams per practice, each with its own objective.
- Three maturity levels per practice.
How people use SAMM
According to the project page, you assess where you are, set a target maturity for each practice, build a roadmap in iterations and track progress. SAMM does not require the highest level everywhere. That point matters. A team does not need level three in every practice, and chasing it wastes effort.
Choosing between them
- What controls must this application have? ASVS.
- How do we test those controls? ASVS.
- How mature is our whole program? SAMM.
- Where should we invest next year? SAMM.
- What do we tell a customer who asks for a standard? ASVS for an application, SAMM for a program.
They also work together. SAMM can tell you that verification is a weak practice. ASVS can then supply the requirements you verify against.
What neither one is
Neither is a certification, and neither tells you which scanner to buy. If a vendor says its tool is aligned to either one, ask what that means in practice: which requirements it helps verify, and how you would show that to an auditor. Our post on mapping the NIST CSF for AppSec teams shows a similar mapping exercise.
Where Safeguard fits
Safeguard offers compliance and evidence automation, plus SBOM and dependency scanning. The free scan at gold.safeguard.sh/scan shows what it finds in a repository.
Quick check
Can I use ASVS to assess my whole program?
It is aimed at verifying web application controls. For a program level view, SAMM is the closer fit.
Does SAMM require maturity level three everywhere?
No. The project says to set a target level per practice.
Sources
Last reviewed: 19 October 2026.
