OWASP ASVS
What is OWASP ASVS?
OWASP Application Security Verification Standard. It comprises 14 controls organised across 14 domains, published by OWASP Foundation, and applies in International.
How OWASP ASVS maps to other frameworks
All 14 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 14 domains OWASP ASVS groups its controls into
Frameworks that share controls with OWASP ASVS
Each of these has at least one control mapped to a control in OWASP ASVS. The number is how many OWASP ASVS controls are shared, counted from the mapping graph.
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)
8 shared controlsFedRAMP Rev 5
8 shared controlsISMAP (Japan)
8 shared controlsMITRE D3FEND
8 shared controlsMTCS (Singapore)
8 shared controlsOpenSSF Scorecard
8 shared controlsNIST SP 800-92
8 shared controlsNIST SP 800-88
8 shared controlsWhere OWASP ASVS overlaps with the standards you already hold
Where to get trained on OWASP ASVS
One course in the catalogue covers OWASP ASVS directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 14 OWASP ASVS controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the OWASP ASVS evidence request listWhat OWASP ASVS means in your sector
What OWASP ASVS means for your job
Questions people ask about OWASP ASVS
What is OWASP ASVS?
How many controls does OWASP ASVS have?
Where does OWASP ASVS apply?
What frameworks does OWASP ASVS map to?
How do I get started with OWASP ASVS compliance?
Query OWASP ASVS programmatically
OWASP ASVS, its 14 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
OWASP ASVS API reference and MCP config →What OWASP ASVS requires, control by control
Each page carries the requirement text for one OWASP ASVS control and what an assessor expects to see as evidence.
- OWASPASVS-1 Architecture, Design and Threat Modelling (V1)
- OWASPASVS-10 Malicious Code Verification (V10)
- OWASPASVS-2 Authentication and Credential Storage (V2 + V2.4)
- OWASPASVS-4 Access Control (V4 + V4.3)
- OWASPASVS-6 Stored Cryptography (V6)
- OWASPASVS-7 Error Handling and Logging (V7)
- OWASPASVS-8 Data Protection (V8 + V8.3)
- OWASPASVS-9 Communication Security (V9)
How ready are you for OWASP ASVS?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.