OWASP Top 10

Supply chain and component risk categories: outdated components, integrity, broken access control.


Short name	OWASP
Region	International
Country or scope	International
Sector	Application Security
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers OWASP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 30 controls from Safeguard's control catalog for OWASP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for OWASP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`OWASP-A06-INV` Know Your Components	Avoiding vulnerable and outdated components starts with an inventory of all client-side and server-side components in use (OWASP Top 10 2021, A06)	Scan
`OWASP-A06-VER` Component Versions Known	You are likely vulnerable if you do not know the versions of all components and nested dependencies you use (OWASP Top 10 2021, A06)	Scan
`OWASP-A06-SCAN` Continuous Vulnerability Matching	Components must be continuously checked against sources like CVE and NVD, which requires standard identifiers (PURL/CPE) on each component (OWASP Top 10 2021, A06 prevention guidance)	Scan
`OWASP-A06-DEPS` Nested Dependency Visibility	A06 explicitly covers direct and nested dependencies, so the dependency relationships among components must be documented (OWASP Top 10 2021, A06)	Scan
`OWASP-A08-INT` Software Integrity Verification	Software and data integrity failures arise when code from untrusted sources is consumed without integrity verification; components should carry hashes enabling digital verification (OWASP Top 10 2021, A08)	Scan
`OWASP-A08-SRC` Trusted Component Sources	Consuming libraries only from trusted sources and repositories requires knowing the supplier of each component (OWASP Top 10 2021, A08 prevention guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`A01:2021-1`	Enforce Least-Privilege Access Control
`A01:2021-2`	Prevent Insecure Direct Object References
`A01:2021-3`	Enforce CORS Policy and Path Traversal Protections
`A02:2021-1`	Prohibit Weak or Deprecated Cryptographic Algorithms
`A02:2021-2`	Encrypt Data at Rest and in Transit
`A02:2021-3`	Manage Cryptographic Key Lifecycle
`A03:2021-1`	Prevent SQL and NoSQL Injection
`A03:2021-2`	Prevent OS Command and LDAP Injection
`A03:2021-3`	Prevent Cross-Site Scripting (XSS)
`A04:2021-1`	Conduct Threat Modeling During Design
`A04:2021-2`	Enforce Security Design Patterns
`A04:2021-3`	Implement Rate Limiting and Anti-Automation
`A05:2021-1`	Harden Default Security Configurations
`A05:2021-2`	Set Secure HTTP Security Headers
`A05:2021-3`	Manage Cloud Storage and Service Permissions
`A06:2021-1`	Maintain a Software Bill of Materials (SBOM)
`A06:2021-2`	Scan Dependencies for Known Vulnerabilities
`A06:2021-3`	Define Patch and Upgrade SLAs
`A07:2021-1`	Enforce Multi-Factor Authentication
`A07:2021-2`	Implement Secure Session Management
`A07:2021-3`	Prevent Credential Enumeration and Stuffing
`A08:2021-1`	Verify Software Integrity via Digital Signatures
`A08:2021-2`	Protect CI/CD Pipeline Integrity
`A08:2021-3`	Validate Deserialization of Untrusted Data
`A09:2021-1`	Log Security-Relevant Events with Sufficient Detail
`A09:2021-2`	Centralize and Protect Log Storage
`A09:2021-3`	Define and Test Alerting Thresholds
`A10:2021-1`	Validate and Sanitize Server-Side Request Targets
`A10:2021-2`	Enforce Network Segmentation for Outbound Traffic
`A10:2021-3`	Disable Unnecessary URL Schemes in HTTP Clients

Policy templates

Written for OWASP:

Application Security Policy (OWASP Top 10)
Secure Software Development Lifecycle Policy

And 22 from the standard set, adapted to OWASP.