OWASP MASVS

Mobile Application Security Verification Standard: component inventory, third-party tracking.


Short name	MASVS
Region	International
Country or scope	International
Sector	Application Security
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MASVS

Scan requirements: 5: 4 decided by a scan, 1 that needs evidence or an attestation.
Controls: the scan requirements below, plus 6 controls from Safeguard's control catalog for MASVS.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for MASVS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Scan: the scan decides whether the requirement is met.
Evidence: a scan cannot see what the requirement asks for. It passes when a person attests it with evidence.

Requirement	What Safeguard checks	Decided by
`MASVS-NOT-ASSESSED` OWASP MASVS was not assessed	The requirements below are inferred from SBOM component names, not from testing the application. They are a dependency inventory and must NOT be presented as MASVS conformance evidence.	Evidence
`MASVS-STORAGE-1` Secure Storage Components	MASVS requires secure data storage components	Scan
`MASVS-CRYPTO-1` Cryptography Verification	MASVS requires strong cryptography	Scan
`MASVS-AUTH-1` Authentication Components	MASVS requires secure authentication libraries	Scan
`MASVS-NETWORK-1` Network Security Components	MASVS requires secure network communication	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MASVS-STORAGE-2`	Prevent Sensitive Data Exposure via Backup Mechanisms
`MASVS-PLATFORM-1`	Restrict WebView Capabilities
`MASVS-CODE-1`	Remove Debug Code and Logging from Release Builds
`MASVS-RESILIENCE-1`	Detect and Respond to Runtime Tampering
`MASVS-PRIVACY-1`	Minimize Personal Data Collection on Mobile
`MASVS-PRIVACY-2`	Provide User Controls for Personal Data

Policy templates

Written for MASVS:

Mobile Application Security Policy (OWASP MASVS)
Mobile Application Tamper Resistance and Resilience Policy

And 22 from the standard set, adapted to MASVS.