OWASP MASVS control groups: what each of the eight covers

The OWASP Mobile Application Security Verification Standard (MASVS) is the verification standard for mobile app security. Its page lists eight control groups containing 24 controls in total: Storage, Crypto, Auth, Network, Platform, Code, Resilience and Privacy. Here is what each group is about and how to start using them.

The groups and control counts

From the MASVS page:

• MASVS-STORAGE: 2
• MASVS-CRYPTO: 2
• MASVS-AUTH: 3
• MASVS-NETWORK: 2
• MASVS-PLATFORM: 3
• MASVS-CODE: 4
• MASVS-RESILIENCE: 4
• MASVS-PRIVACY: 4

What each group is about

The names tell you the area. A short reading for each:

• Storage: how the app keeps sensitive data on the device.
• Crypto: use of cryptography for that data and for communication.
• Auth: how users and sessions are authenticated and authorized.
• Network: protection of data in transit.
• Platform: how the app interacts with the operating system and other apps.
• Code: code quality, third party components and handling of input.
• Resilience: resistance to reverse engineering and tampering.
• Privacy: handling of user data and consent.

The summaries above are a plain reading of the group names, not quotes from the standard. Read the control text itself before you test against it.

How MASVS fits with other OWASP mobile projects

The MAS site also hosts the testing guide, MASTG, which has Android and iOS testing material organized by MASVS category, and a list of weakness entries, MASWE, grouped under the same categories. In short: MASVS says what to check, MASTG says how, and MASWE names the weaknesses.

Using it in a project

1. Choose which groups apply. Most apps touch all of Storage, Network, Auth and Code.
2. Treat Resilience as a risk decision. Banking and payment apps need it more than a recipe app.
3. Turn each control into a test or review step, and record the evidence.
4. Repeat at releases that change authentication, storage or third party SDKs.

A checklist makes progress visible to product managers and customers, and it helps in security questionnaires.

A starting plan for a small team

If you have never tested against MASVS, do not try to cover all 24 controls in one sprint. Take one group per release.

1. Storage and Network first. They are the most common source of embarrassing findings, such as tokens in plain files or traffic without TLS.
2. Auth next, because it connects to your server side checks.
3. Code and Platform, which include third party SDKs and how the app handles input from other apps and links.
4. Privacy and Resilience last, once you know your risk appetite.

For each control write a one line test, who ran it, the date and the result. That record becomes evidence you can reuse in customer questionnaires. Keep it in the same tracker as other engineering work, so failed items become tickets and not slides.

Quick check

Sources

• OWASP MASVS

Last reviewed: 19 October 2026.