OWASP Top 10
What is OWASP Top 10?
A regularly updated report from the Open Web Application Security Project that lists the ten most critical web application security risks. The OWASP Top 10 is widely adopted as a baseline for web application security testing.
Terms that appear alongside owasp top 10
Each of these is named in at least one of the same controls as owasp top 10. The number is how many controls name both.
- owasp 17 shared controls
- policy 4 shared controls
- authentication 4 shared controls
- security testing 3 shared controls
- threat modelling 3 shared controls
- software bill of materials sbom 3 shared controls
- software bill of materials 3 shared controls
- integrity 3 shared controls
Frameworks that govern owasp top 10
What the standards actually require on owasp top 10
Requirements naming owasp top 10 across 6 standards, quoted from the control text.
The OWASP Top 10 Proactive Controls are used in the development of web applications.
ISM-1849 · Using the OWASP Top 10 Proactive Controls →Application security assessments must be comprehensive, not confined to the OWASP top 10, drawing on other recognised standards as appropriate.
rbi-cybersecurity-framework-for-banks::85 · Para 85: application security assessments beyond the OWASP top 10 →Address OWASP Top 10 A10 Server-Side Request Forgery (SSRF) per OWASP Top 10:2025. SSRF occurs when an application fetches a remote resource without validating the user-supplied URL allowing internal network access + cloud metadata service access + or other un...
OWASPTOP10-10 · A10:2025 Server-Side Request Forgery (SSRF) →Provide developers with secure coding training covering OWASP Top 10, AWS specific risks, IAM least privilege and use of managed security services.
SEC11-BP01 · Train for application security →Provide security awareness and skills training tailored to specific roles, for example secure systems administration courses for IT staff, OWASP Top 10 awareness and prevention training for web developers, and advanced social engineering awareness for high-pro...
CIS-14.9 · Conduct Role-Specific Security Awareness and Skills Training →Provide security awareness and skills training tailored to specific roles, for example secure administration courses for IT staff, OWASP Top 10 training for web developers and advanced social engineering training for prominent roles.
cis-controls-v8-1::14.9 · Conduct Role-Specific Security Awareness and Skills Training →Questions people ask about owasp top 10
What is OWASP Top 10?
Why is OWASP Top 10 important for compliance?
Which compliance frameworks address OWASP Top 10?
Where can I learn more about OWASP Top 10?
See how OWASP Top 10 applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.