The OWASP Application Security Verification Standard (ASVS) v4.0.3 is the most widely adopted open framework for defining and verifying web application and API security requirements. Organised into 14 control categories and 286 security requirements across three verification levels — Level 1 (opportunistic, automated), Level 2 (most applications), and Level 3 (critical systems) — ASVS provides a comprehensive checklist that developers, architects, security engineers, and penetration testers use to build, review, and verify secure applications.
ASVS bridges the gap between development and security — replacing vague "secure coding" requirements with specific, testable controls covering authentication, session management, access control, input validation, cryptography, error handling, data protection, communications security, malicious code prevention, business logic, file handling, API security, and configuration. It is the reference standard used in security code reviews, DAST/SAST tool configuration, bug bounty programmes, and penetration testing scopes across the industry.