ASVS Project
summary
Comprehensive application-security requirements live in a GitHub repo as Markdown and export to PDF/Word/JSON via scripts, with a master branch for ongoing edits and a 5.0 roadmap aiming for release by year end. The standard defines ~130 level‑one requirements, a roughly equal second level and a small +20 level‑three addendum, maps key controls to NIST 863B, includes practical checks (password breach lookups, SSRF guidance, cookie host‑prefix), is verifiable by hybrid penetration testing, and has ~50–100 active contributors.
AI-written summary · about
chapters (12)
- 0:00Start
- 9:22What is the ASVS?
- 11:05ASVS Level 2
- 16:11Key information
- 24:12Today's vulnerabilities, today
- 26:15Actually useful practices
- 32:04But how do I do it...?
- 34:05Who is using the ASVS?
- 35:32How can I use the ASVS
- 39:28Key principles for 5.0
- 41:47Use the standard
- 43:33Support the standard
related talks
39mIntroducing the ASVS 4.0
24mFlagship Projects: Application Security Verification Standard
55mBuilding a sustainable security requirements process with the ASVS
35mGetting benefits of OWASP ASVS at initial phases
35mOWASP Application Security Verification Standard (ASVS)
01h 02mFrom the OWASP Top Ten(s) to the OWASP ASVS
41mFrom the OWASP Top Ten(s) to the OWASP ASVS
39mHandling of Security Requirements in Software Development Lifecycle