OWASP ASVS: Application Security Verification Standard

The Application Security Verification Standard (ASVS) is a framework of security requirements for web applications. It provides three verification levels (L1, L2, L3) and over 200 detailed security controls organized into chapters covering all aspects of application security.

L1 applies to all applications — basic security controls. L2 is for applications handling sensitive data — most requirements. L3 is for high-assurance applications (financial, healthcare) requiring the most rigorous verification. Most teams target L2.

ASVS V1 requires a documented security architecture, threat model, documented trust boundaries, and separation of components by sensitivity. Architecture reviews catch systemic flaws before they become widespread implementation issues.

V2 covers password requirements (minimum length, breach password checking, secure hashing), session management, multi-factor authentication requirements, credential recovery security, and protection against brute force attacks.

Sessions must use cryptographically random tokens of sufficient length, be invalidated on logout and timeout, be protected from fixation, and cookies must use Secure, HttpOnly, and SameSite=Strict attributes where applicable.

Every resource access must be authorized server-side. ASVS V4 requires deny by default, directory traversal prevention, vertical and horizontal privilege escalation prevention, and that access control decisions are logged.

V5 covers all injection prevention: parameterized queries for SQL, command injection prevention, safe XML parsing (XXE prevention), HTTP header injection, and context-sensitive output encoding for XSS prevention.

Applications must not expose stack traces or internal paths to users. Security events (authentication failures, access control violations, input validation failures) must be logged with sufficient detail for incident investigation without logging sensitive data.

Sensitive data must be identified and classified. Secrets and PII must be encrypted at rest and in transit. Caches and temporary files must not store sensitive data. Data must be purged when no longer needed, following retention policies.

Use ASVS as a requirements checklist during development, a test plan during security testing, and an audit framework during compliance reviews. Assign ASVS controls to teams, track completion in your project management tool, and document evidence of compliance.

ASVS maps to NIST 800-53, ISO 27001, and PCI-DSS. Using ASVS as an application security baseline simplifies compliance since controls satisfy requirements across multiple frameworks simultaneously, reducing duplicative assessment effort.

Which OWASP ASVS level is appropriate for most applications handling sensitive user data?

OWASP ASVS provides a comprehensive, structured security requirements framework across authentication, session management, access control, injection prevention, data protection, and more. It bridges security requirements, implementation guidance, and compliance evidence in a single standard.