anchor@anchor-cyber:~$ man asvs-5.0
Anchor Cyber Security
Anchor Cyber Security LLC

OWASP ASVS 5.0 — Field Reference

17 chapters, ~350 requirements across three Levels. Level 2 is the right default for most production web and API applications — this is the chapter index, not a substitute for running the actual checklist.

Version note ASVS 5.0.0 (May 2025) replaced 4.0.3 and restructured 14 chapters into 17 — if you see an older reference to "V1 Architecture" or "V2 Authentication," that's 4.0.3's numbering, not this one. Re-check anything written against the old structure before treating it as current.

The 17 Chapters

V1Encoding and Sanitization
V2Validation and Business Logic
V3Web Frontend Security
V4API and Web Service
V5File Handling
V6Authentication
V7Session Management
V8Authorization
V9Self-Contained Tokens
V10OAuth and OIDC
V11Cryptography
V12Secure Communication
V13Configuration
V14Data Protection
V15Secure Coding and Architecture
V16Security Logging and Error Handling
V17WebRTC
$ asvs --levels

Three Levels, Not a Ladder Everyone Climbs

Level 1 is opportunistic-attacker baseline — the minimum for any app handling anything sensitive. Level 2 is for apps handling significant business, financial, health, or otherwise sensitive data against a skilled, motivated attacker — this is where most web and API applications handling sensitive data should default to. Level 3 is for the highest-value targets (critical infrastructure, high-value financial systems) — don't scope a client there by default just because "more secure" sounds safer; it's a real cost/effort step up, not a strictly-better setting.

$ asvs --triage

Picking Chapters by Architecture Shape

Let the architecture tell you where to start, not the chapter numbering. A product with a local client agent, a network-inspection component, and a cloud-hosted commercial portal should check, in order: V6 (auth on the portal), V8 (authorization — one customer's data must not leak across tenants), V12 (secure communication — anything inspecting or terminating traffic by design makes this chapter unusually load-bearing), V14 (data protection — policy/evidence data at rest), V16 (logging — audit evidence integrity matters most for exactly this kind of product).