asvs-requirements

ASVS 5.0 provides 17 chapters (V1-V17) mapping functional and technical security domains. Reference the relevant chapters for your audit scope, then select verification levels (L1-L3) to define audit depth—L1 for foundational controls, L3 for comprehensive coverage. This guides which requirements to verify and what evidence to collect.

ASVS defines three verification levels: L1 covers basic security controls, L2 addresses advanced threats, and L3 provides defense-in-depth. Use these levels to align audit scope with organizational risk tolerance and resources, ensuring checks match the required assurance depth.

Yes. The ASVS database supports cross-domain references across all 17 chapters, enabling you to categorize and trace findings to specific requirements. This creates structured audit reports and ensures comprehensive coverage without gaps or duplicates.

ASVS 5.0 provides structured functional and technical requirements accessible as a database. Parse the relevant chapters and verification levels for your audit scope, then embed this mapping into your agent logic to automate requirement selection, evidence matching, and finding classification.

Functional requirements define what security controls must achieve (e.g., authentication enforcement). Technical requirements specify how to implement them (e.g., password hashing algorithms). ASVS 5.0 structures both separately, enabling audit planning at either abstraction level.