OWASP Documentation Project

Application Security Verification Standards (ASVS)

Application Security Verification Standards are specifications produced by OWASP in cooperation with secure applications developers and verifiers worldwide for the purpose of accelerating the deployment of secure web applications. First published in 2008 as a result of an OWASP Summer of Code grant and meetings with a small group of early adopters, the ASVS documents have become widely referenced and implemented.

Further development of ASVS occurs through mailing list discussions and occasional workshops, and suggestions for improvement are welcome. For more information, please contact us.

Application Security Verification Standards

• Web Application Verification Standard
• Web Service Verification Standard
• Cloud Verification Standard
• Client-Server Verification Standard

Application Security Verification Providers

• Verification Providers

How ASVS Works

ASVS defines four levels of application security verification. Each level includes a set of requirements for verifying the effectiveness of security controls that are being used.

Latest News

• OWASP ASVS is the subject of an opinion piece by Mike Boberski in SC Magazine on the need for a web app standard
• OWASP ASVS users and adopters list updated to include Federal Deposit Insurance Corporation (FDIC)
• OWASP ASVS is presented by Dave Wichers at OWASP Software Assurance Day DC 2009 in conjunction with the Software Assurance Forum sponsored by the US Department of Homeland Security, Department of Defense and National Institute of Standards and Technology.
• Request for users/adopters/supporters. Please let us know your stories!
• ASVS News Archives
• ASVS Announcement Feed
• ASVS Mailing List

About Verification Providers

One of the main objectives of the ASVS is to provide a basis for specifying web application security verification requirements in contracts. The OWASP Secure Software Contract Annex has in fact been updated to make use of the ASVS. Where can one go to find a business that you can call on to perform an OWASP ASVS verification? The answer is here. A registry of businesses that perform application security verifications according to OWASP ASVS is provided on this page. These businesses are called “verification providers”.

Verification providers listed on this page have made a commitment to perform application security verifications according to OWASP ASVS requirements. Verification providers listed here are not accredited by OWASP. Neither their products or services have been endorsed by OWASP. OWASP has also not made a determination as to the business’ quality or competency in performing services. Businesses are under no obligation to seek inclusion in the list below in order to perform application security verifications according to OWASP ASVS.

How to Add Your Company to the Verification Provider Registry

Verification providers listed on this page are OWASP Organizational Supporters and have made a commitment to make a good faith effort to resolve any consumer complaints that are specific to their use of the OWASP ASVS to perform application security verifications. This verification provider registry is made available only to OWASP Organizational Supporters as an Organizational Supporter benefit.

Contact: Mike Boberski. Provide the following information:

• Company name and web site URL
• Company mailing address
• Point of contact's name
• Point of contact's phone number
• Point of contact's email address
• ASVS Levels that your company performs (Select one or more: 1A, 1B, 2A, 2B, 3, 4)

How to File a Complaint Against a Registered Verification Provider

If you are a customer of a verification provider listed below, and if a verification report provided to you does not include the required content according to OWASP ASVS reporting requirements, you can enlist the OWASP Foundation to forward a complaint on your behalf to the verification provider, if you have already attempted to work with the provider to resolve the issue. Contacting the provider and attempting to work with the provider should always be the first step towards the end of ensuring that provided reports contain the required content.

Contact: Kate Hartman. Provide the following information:

• Your name and phone number.
• The name of the verification provider
• The targeted OWASP ASVS Level
• Which verification report section(s) are missing

In some cases, the OWASP may contact you for additional information about your complaint. OWASP will then forward the complaint to the company involved. Occasionally, OWASP may be unable to obtain any cooperation from the company. In extreme cases, OWASP may de-list the verification provider from the registry in this article. Please note that we only take complaints on companies that are OWASP Organizational Supporters.

Verification Providers

Booz Allen Hamilton
8283 Greensboro Drive
McLean, Virginia  22102-3828
POC: Mr. Mike Boberski
Phone: (703) 377-0456
Email: Mike Boberski
ASVS Levels Available: 
1A, 1B, 2A, 2B

Project Leader

• Mike Boberski

Project Contributors

• Jeff Williams
• Dave Wichers

Project Sponsorship

Users and Adopters

Pilots are already underway at various companies and agencies around the globe. A broad range of companies and agencies around the globe are also using OWASP ASVS, including:

• Aspect Security
• Booz Allen Hamilton
• Federal Deposit Insurance Corporation (FDIC)
• ps_testware

Please let us know how your organization is using OWASP ASVS. Include your name, organization's name, and brief description of how you use the standard. The project lead can be reached at [email protected] Thanks for supporting OWASP!