Compliance FrameworksInternational
OWASP ASVS
Application Security Verification Standard V14: dependency inventory, version verification, integrity.
Application Security Verification Standard V14: dependency inventory, version verification, integrity.
| Short name | ASVS |
| Region | International |
| Country or scope | International |
| Sector | Application Security |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ASVS
- Scan requirements: 4, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ASVS.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 24: 2 written for ASVS and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ASVS-V2 Authentication Components | ASVS V2 requires documented authentication | Scan |
ASVS-V3 Session Management | ASVS V3 requires secure session management | Scan |
ASVS-V4 Access Control Components | ASVS V4 requires access control documentation | Scan |
ASVS-V6 Cryptographic Algorithm Audit | ASVS V6 requires approved cryptographic algorithms | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ASVS-V1.1.2 | Document and Review Application Architecture |
ASVS-V2.1.1 | Enforce Minimum Password Length and Complexity |
ASVS-V2.2.1 | Require MFA for High-Value Accounts |
ASVS-V3.2.1 | Generate Secure Session Tokens |
ASVS-V4.1.1 | Enforce Server-Side Access Control |
ASVS-V5.1.1 | Validate All Input Against an Allowlist |
ASVS-V7.1.1 | Do Not Log Sensitive Data |
ASVS-V8.1.1 | Classify and Label Sensitive Data |
ASVS-V9.1.1 | Enforce TLS for All Communications |
ASVS-V10.2.1 | Scan for Malicious Code and Backdoors |
ASVS-V13.1.1 | Authenticate and Authorize All API Requests |
ASVS-V14.2.1 | Pin and Verify Dependency Versions |
Policy templates
Written for ASVS:
- Application Security Verification Requirements Policy (ASVS L2)
- Data Protection and Cryptography Policy (ASVS V8/V2)
And 22 from the standard set, adapted to ASVS.