OWASP ASVS and MASVS Application Reviews

Overview

The Application Security Verification Standard (ASVS) and its mobile counter-part Mobile Application Security Verification Standard (MASVS) are two review methodologies published by the Open Web Application Security Project (OWASP) which is a membership organization with a mission to provide educational content and standards free to the public to increase everyone’s security.

These standards provide a free and open methodology to systematically assess the security posture of your custom web application, web api, mobile, and (with some adjustments) desktop native applications.

The Standards

The ASVS and MASVS are the benchmarks behind our application vulnerability assessment. This page describes the two standards in more detail.

ASVS 5.0 (web applications and APIs)

ASVS 5.0, released in May 2025, groups its requirements into 17 chapters:

1. V1 Encoding and Sanitization
2. V2 Validation and Business Logic
3. V3 Web Frontend Security
4. V4 API and Web Service
5. V5 File Handling
6. V6 Authentication
7. V7 Session Management
8. V8 Authorization
9. V9 Self-contained Tokens
10. V10 OAuth and OIDC
11. V11 Cryptography
12. V12 Secure Communication
13. V13 Configuration
14. V14 Data Protection
15. V15 Secure Coding and Architecture
16. V16 Security Logging and Error Handling
17. V17 WebRTC

It defines three verification levels, L1, L2, and L3, each increasing in depth. Organizations generally start at L1 and move up according to the application’s needs. Earlier ASVS versions, such as 4.0, used a different set of 14 chapters, so a report against 4.0 and a report against 5.0 don’t line up chapter for chapter.

MASVS (mobile apps)

MASVS groups its controls into eight categories:

1. MASVS-STORAGE, secure storage of sensitive data on the device
2. MASVS-CRYPTO, cryptography
3. MASVS-AUTH, authentication and authorization
4. MASVS-NETWORK, secure network communication
5. MASVS-PLATFORM, interaction with the mobile platform
6. MASVS-CODE, code quality and build settings
7. MASVS-RESILIENCE, resilience against reverse engineering and tampering
8. MASVS-PRIVACY, user privacy

Review Service

Our application vulnerability assessment reviews your application source code and how it is deployed, to show you where it stands against ASVS or MASVS. We work with your team to understand your needs and produce a detailed report including actionable recommendations on how to address any gaps. Importantly, we understand how to tailor the standards to your specific context by excluding requirements that are not applicable to your situation, ensuring an efficient and effective review. Our process typically involves an initial consultation, source code analysis (and dynamic testing where relevant), a detailed findings report, and collaboration on remediation strategies.

Our clients have successfully satisfied their third-party audit requirements in regulated industries by utilizing our service. Frank Rietta, a life member of OWASP, can provide signed attestation or bridge letters as appropriate to help address concerns that your stakeholders may have.

Not Authorized by OWASP

Please note that OWASP does not accredit or authorize specific companies to conduct assessments against ASVS or MASVS. Our use of their mark on this page is for fair use only to clearly identify the standards that we follow. You are free to read and follow these standards on your own or use any consultant or contractor of your choice.

Frank Rietta is a life member of OWASP, believes strongly in their mission, and supports the local club organization.