// GLOSSARY

OWASP ASVS

OWASP Application Security Verification Standard, the web application security verification standard. With categories spanning authentication, access control, data protection and business logic, it defines security control requirements in layers and, with three verification levels (L1-L3), scales the security maturity expected of an application. Application Security Penetration Test reports can be presented aligned with ASVS categories, and it is used for control mapping in the audit-ready evidence package. Its real value is a translation function: a penetration test naturally speaks the language of 'this finding, that vulnerability', while an auditor or manager speaks the language of 'which requirement is met, which is open'. ASVS ties these two languages together; it turns a list of 'what we found' into a table of 'which verification item passed, which failed'. A technical finding thus gains a structured form the organization's compliance and assurance counterparts recognize, and the report addresses not only the technical team but decision-makers too. Its mobile counterpart is OWASP MASVS/MASTG.