Use the OWASP Application Security Verification Standard as a menu of requirements, so teams do not invent security rules from scratch for each project. ASVS provides a basis for testing web application technical security controls and a list of requirements for secure development. The project page lists 5.0.0 as the latest stable version.
Why a baseline helps
Without one, every project writes its own security requirements, or has none. Reviews then depend on who attends. A shared list gives developers, testers and reviewers a common vocabulary and makes the result comparable between teams.
OWASP says ASVS aims to standardize how broadly and rigorously web application security is verified.
How to adopt it without overload
- Read the current version's chapters and note which apply to your product type.
- Pick the subset that matches your risk. Not every product needs every requirement.
- Copy the chosen requirements into a living checklist.
- Link each requirement to a test, a design pattern or a review step.
- Revisit when the product handles new data or a new audience.
Check the project page for how levels are defined in the version you use, because the details differ between versions and should be confirmed there.
Where it plugs into your program
- Threat modeling: use a requirement as the mitigation for a threat.
- Design review: ask which requirements the feature touches.
- Testing: write test cases from requirements.
- Vendor and customer questions: answer using requirements you actually verified.
What ASVS does not do
It does not tell you what to build, and it does not replace threat modeling. A requirement list reflects known good practice. Your system's own threats, especially business logic abuse, need your own analysis.
Avoiding checkbox culture
The Threat Modeling Manifesto warns against box ticking over a culture of finding and fixing design issues. Use ASVS as a prompt for conversation. A team that can explain why a requirement matters is better off than one that ticks every row.
A first scoping exercise
Take one product and read through the chapters with the team for an hour. Mark each requirement as applies, does not apply or not sure. Pick five from the applies list that your product does not clearly meet today and make them the first requirements to design for. Document the not applies list with reasons so the next reviewer does not repeat the debate.
Quick check
Is ASVS only for web apps?
The project describes itself as a basis for testing web application technical security controls. For mobile apps, look at other OWASP standards.
Should we require every ASVS item?
Usually not. Scope to your risk and document what you excluded and why.
Sources
Last reviewed: 19 October 2026.
