Skip to content

OWASP

What is OWASP?

The Open Worldwide Application Security Project, a non-profit foundation that produces resources and tools for improving software security.

Information Security

Terms that appear alongside owasp

Each of these is named in at least one of the same controls as owasp. The number is how many controls name both.

Frameworks that govern owasp

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →ISO 27001:2022View framework →

What the standards actually require on owasp

Requirements naming owasp across 6 standards, quoted from the control text.

Australian Information Security Manual3 controls

The OWASP Top 10 Proactive Controls are used in the development of web applications.

ISM-1849 · Using the OWASP Top 10 Proactive Controls →
RBI Cybersecurity Framework for Banks2 controls

Development practices proactively address vulnerabilities based on best practice and baselines such as OWASP and apply defence in depth.

rbi-cybersecurity-framework-for-banks::84 · Para 84: address vulnerabilities per OWASP and defence in depth →
New Zealand Information Security Manual (NZISM)1 control

Agencies should follow the Open Web Application Security Project (OWASP) guide documentation when building secure Web applications and Web services.

new-zealand-information-security-manual-nzism::14.5.8.C.01 · 14.5.8.C.01 Build web applications to OWASP guidance →
OWASP ASVS14 controls

Per OWASP ASVS V12: protect file handling + resources. Requirements include (a) validate file uploads including type + size + content + scanning + (b) sandbox file processing + storage + serving + (c) protect against path traversal + null byte injection + simi...

OWASPASVS-12 · File and Resources (V12) →
OWASP Top 10:202510 controls

Address OWASP Top 10 A10 Server-Side Request Forgery (SSRF) per OWASP Top 10:2025. SSRF occurs when an application fetches a remote resource without validating the user-supplied URL allowing internal network access + cloud metadata service access + or other un...

OWASPTOP10-10 · A10:2025 Server-Side Request Forgery (SSRF) →
OWASP API Security Top 10 - 20238 controls

Address API3:2023 Broken Object Property Level Authorization (BOPLA) per OWASP API Security Top 10 2023. BOPLA combines previous API3 Excessive Data Exposure and API6 Mass Assignment categories.

OWASPAPI-3 · Broken Object Property Level Authorization (BOPLA) →

Questions people ask about owasp

What is OWASP?
The Open Worldwide Application Security Project, a non-profit foundation that produces resources and tools for improving software security.
Why is OWASP important for compliance?
OWASP is a key concept in Information Security. Understanding owasp helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address OWASP?
OWASP appears in the requirement text of Australian Information Security Manual, RBI Cybersecurity Framework for Banks, New Zealand Information Security Manual (NZISM), OWASP ASVS, OWASP Top 10:2025. Across these standards we have identified 38 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about OWASP?
Explore our compliance framework pages to see how owasp applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how OWASP applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.