OWASP ASVS Assessment — Verify Your Application Security, Level by Level
The ASVS turns application security into a list of testable requirements. Instead of “is it secure?”, you can show which verified requirements an application meets at Level 1 (baseline), Level 2 (most business applications) or Level 3 (high-value and critical systems).
Mutex Systems uses the ASVS both as a pen-testing method and as a requirements set for development teams, so security is designed in rather than tested in at the end.
- Category
- Testing Methodology
- Jurisdiction
- International
- Issuing Body
- OWASP Foundation
- Current Version
- ASVS 5.0 (released May 2025)
- Who It's For
- Software teams, SaaS companies and buyers who need a measurable application security standard — especially those selling to banks, government and enterprise customers.
Core Domains
A Practical Engagement Path
- 01
Choose the level
Agree Level 1, 2 or 3 for each application based on the data and functions it handles.
- 02
Verify
Combine design review, code review and testing to verify each requirement.
- 03
Gap report
Pass, fail or not-applicable for every requirement, with fixes for each gap.
- 04
Build it in
Turn the requirements into user stories, CI checks and acceptance criteria.
A standard your developers can build to
We translate ASVS requirements into the language and backlog of your development team, so the next release passes without a scramble.
- ASVS level recommendation per application
- Requirement-by-requirement verification report
- Developer workshop on the failed requirements
ASVS as a framework in grComply
ASVS can be loaded into grComply as a framework, with each requirement tracked as a control and evidenced by code scans, test results and review notes.
- ASVS requirements tracked per application
- Code scanning in GitHub workflows as continuous evidence
- Mapping to ISO 27001, PCI DSS and SOC 2 controls
- Progress per level visible to buyers and auditors
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About OWASP ASVS
What are the ASVS levels?
Level 1 is a baseline for all applications, Level 2 is recommended for most applications handling sensitive data, and Level 3 is for the most critical applications such as high-value financial or health systems.
Can you be certified against ASVS?
There is no official ASVS certification. Organisations show compliance through an independent verification report, which is what we provide.
What is new in ASVS 5.0?
Version 5.0, released in 2025, reorganised and renumbered the requirements and updated them for modern architectures. Reports against older versions should be refreshed when you next test.
Ready to Start Your OWASP ASVS Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.