OWASP ASVS

Per OWASP ASVS V1: ensure verified application architecture + secure design + threat modelling. Requirements include (a) maintain documented secure software development lifecycle (SDLC) including security activities at requirements + design + implementation + testing + release phases + (b) conduct threat modelling at design + revise on significant change + maintain documented threat model output + (c) maintain a documented secure architecture with defined trust boundaries + components + data flows + (d) maintain authentication + session management + access control architecture aligned to the rest of ASVS + (e) maintain shared component + library + service inventory with managed dependency lifecycle + (f) implement secure design principles (defense in depth + least privilege + fail securely + complete mediation + secure defaults).

• OWASP ASVS V1 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V10: protect against malicious code. Requirements include (a) integrate static + dynamic + interactive application security testing in CI/CD pipeline + (b) maintain dependency inventory + SBOM + scan for vulnerabilities + license issues + malicious packages + (c) verify package provenance + signing + (d) implement code signing for application code + scripts + container images + (e) protect against supply chain attacks via dependency confusion + typosquatting + repository compromise + (f) implement runtime application self-protection (RASP) + similar runtime protections where appropriate.

• OWASP ASVS V10 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V11: verify business logic. Requirements include (a) identify + threat-model business logic flows including sensitive operations + multi-step workflows + (b) implement business logic security controls including step ordering + state validation + replay prevention + (c) protect against business flow abuse via automation + scalping + scraping + fake transaction generation + (d) implement transaction limits + velocity controls + anomaly detection + (e) test business logic via negative testing + abuse case modelling + (f) maintain monitoring + alerting for business logic abuse.

• OWASP ASVS V11 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V12: protect file handling + resources. Requirements include (a) validate file uploads including type + size + content + scanning + (b) sandbox file processing + storage + serving + (c) protect against path traversal + null byte injection + similar file attacks + (d) implement secure file download + appropriate Content-Disposition + content type + (e) protect against ZIP slip + similar archive attacks + (f) implement resource limits against denial of service + (g) maintain inventory + classification of files + resources.

• OWASP ASVS V12 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V13: secure APIs + web services. Requirements include (a) implement authentication + authorisation consistently across all API endpoints + (b) implement input validation + output encoding + against OWASP API Security Top 10 + (c) maintain API documentation + version management + lifecycle including secure retirement + (d) implement rate limiting + quota management + bot management against abuse + (e) protect against API-specific attacks (BOLA + BFLA + BOPLA + SSRF + Mass Assignment + Excessive Data Exposure) + (f) implement API gateway controls (authentication + rate limiting + logging + threat protection) + (g) align to OWASP API Security Top 10 controls.

• OWASP ASVS V13 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V14: implement secure configuration. Requirements include (a) maintain hardened baseline configurations across application + middleware + runtime + container + cloud infrastructure + (b) implement configuration management with drift detection + remediation + (c) disable unnecessary features + services + endpoints + debug + verbose error messages + (d) implement secure deployment pipeline with infrastructure as code + signed artefacts + (e) apply security headers (HSTS + CSP + X-Content-Type-Options + Referrer-Policy + Permissions-Policy + similar where applicable) + (f) protect secrets via dedicated secret store + (g) maintain CI/CD security including pipeline isolation + artifact integrity + deployment approvals.

• OWASP ASVS V14 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V2 + V2.4: implement strong authentication + credential storage. Requirements include (a) implement password strength requirements aligned with NIST SP 800-63B + reject compromised passwords against published breach lists + (b) implement secure password storage using salted strong adaptive hashing (Argon2 + bcrypt + PBKDF2 + scrypt at appropriate work factor) + (c) implement multi-factor authentication for sensitive operations + privileged accounts + (d) implement credential lifecycle management including reset + change + rotation + revocation + (e) implement rate limiting + account lockout against brute force + credential stuffing + (f) implement secure recovery (no security questions for high-assurance + identity verification for password reset + (g) align to OAuth 2.0 + OIDC + FIDO2/WebAuthn standards where applicable.

• OWASP ASVS V2 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V3: implement secure session management. Requirements include (a) generate cryptographically random session tokens of sufficient entropy + (b) protect tokens against session fixation + replay + theft + (c) implement secure cookie attributes (Secure + HttpOnly + SameSite + Path + Domain + (d) implement session timeout (idle + absolute) + appropriate to risk + (e) implement session termination on logout + password change + privilege change including all-device logout + (f) protect against session ID enumeration + (g) implement CSRF protection via SameSite cookies + token validation + or framework-provided mechanisms.

• OWASP ASVS V3 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V4 + V4.3: implement consistent access control. Requirements include (a) implement access control as a server-side enforcement consistently across all endpoints + (b) implement role-based + attribute-based access control where appropriate + (c) implement object-level + property-level access checks consistent with API security + (d) implement deny-by-default policy with explicit allow + (e) protect administrative + privileged endpoints with strong access control + audit + (f) implement separation of duties for sensitive operations + (g) test access control thoroughly across user roles + tenancy boundaries + with negative testing including privilege escalation attempts.

• OWASP ASVS V4 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V5 + V5.3: implement input validation + output encoding. Requirements include (a) validate all input from untrusted sources for format + length + content + character set + (b) use parameterised queries + prepared statements against SQL/NoSQL/LDAP injection + (c) implement output encoding per context (HTML + URL + JSON + JavaScript + CSS + similar) against XSS + injection + (d) use safe markup libraries + Content Security Policy + Trusted Types + (e) validate file uploads (type + size + content + scanning) + sandbox processing + (f) protect against XML external entity (XXE) + deserialisation + template injection + Server-Side Request Forgery (SSRF) + (g) integrate with WAF + framework-provided protections.

• OWASP ASVS V5 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V6: implement secure stored cryptography. Requirements include (a) classify data + apply appropriate cryptographic protection per classification + (b) use industry-vetted algorithms + key sizes + modes + libraries (AES-GCM + ChaCha20-Poly1305 + Argon2 + similar approved choices) + (c) implement key management lifecycle including generation + storage + rotation + revocation + destruction + (d) use HSM or cloud key management service for high-assurance scenarios + (e) protect cryptographic material in memory + during processing + (f) maintain crypto-agility to migrate algorithms when broken + (g) audit cryptographic operations.

• OWASP ASVS V6 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V7: implement secure error handling + logging. Requirements include (a) handle errors without leaking sensitive information (stack traces + internal paths + database errors) to users + (b) log security-relevant events including authentication + authorisation + access control + administrative actions + cryptographic operations + (c) protect log integrity (write-once or cryptographic hashing) + confidentiality + availability + (d) include sufficient context for investigation (timestamp + user + source + action + result) + (e) maintain retention aligned to regulatory + investigative + governance requirements + (f) integrate with SIEM + monitoring + alerting + (g) protect against log injection + log forging attacks.

• OWASP ASVS V7 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V8 + V8.3: implement data protection. Requirements include (a) classify sensitive data + apply appropriate protection per classification + (b) implement encryption at rest + in transit + appropriate to classification + (c) implement data minimisation + retention limits + secure deletion + (d) protect data in memory + during processing + (e) protect against caching + browser history exposure of sensitive data + (f) protect against device storage exposure + (g) implement privacy controls aligned to applicable regulation (GDPR + CCPA + APPI + similar) including data subject rights.

• OWASP ASVS V8 evidence

• test coverage incomplete + threat modelling not maintained

Per OWASP ASVS V9: implement secure communications. Requirements include (a) use TLS 1.2 or later with strong cipher suites + appropriate key sizes for all sensitive communications + (b) implement HSTS + appropriate certificate validation + pinning where applicable + (c) protect against TLS downgrade + man-in-the-middle attacks + (d) implement certificate lifecycle management including monitoring + rotation + revocation + (e) protect internal service-to-service communications equivalent to external communications + (f) implement mutual TLS where appropriate (high-assurance + service-to-service + zero trust) + (g) maintain crypto-agility for protocol + cipher migration.

• OWASP ASVS V9 evidence

• test coverage incomplete + threat modelling not maintained