OWASP ASVS
OWASP Application Security Verification Standard (ASVS)
Published by OWASP (Open Worldwide Application Security Project) Foundation · ASVS 5.0.0
A framework of security requirements for architecting, designing, building, testing, and verifying secure web application technical security controls — used as a basis for testing web application technical security controls and as a requirements list for secure development.
How it’s structured
- Numbered requirements, each identified precisely by version (for example v5.0.0-1.2.5) so testing can reference an exact ASVS release
- Requirements are grouped by verification level so testing depth can be scaled to an application's risk profile
Who it applies to
Development teams, architects, and security testers building or assessing web applications and web services — used as a shared benchmark between a team and its testers.
How Pentforge uses it in an engagement
- Requirement-by-requirement verification during a penetration test or secure code review, scoped to the level agreed for the engagement
- Findings referenced back to the exact ASVS requirement identifier so remediation is unambiguous
What you get
- A findings report mapped to specific ASVS requirement identifiers
- A verification-level scope statement showing what was and wasn't tested
Official source
Pentforge does not issue certificates
We assess against OWASP ASVS — that is a statement about the work, not a certification. Pentforge holds no certifications of its own; the credentials our practitioners hold individually are listed on About.
Request a scoping call