Which OWASP ASVS Level Does Your App Actually Need?

You know you need security. But how much? A pentest once a year? Full SOC2? HIPAA everything?

Most teams either over-engineer it (burning budget on controls they don't need) or under-engineer it (one breach away from losing customer trust). OWASP ASVS gives you a framework to pick the right level.

TL;DR OWASP ASVS defines three security verification levels. Level 1 is basic hygiene that every application should meet. Level 2 applies once you handle sensitive data such as health, finance or PII. Level 3 is for critical systems like banking, government and defense.

What Is OWASP ASVS?

The Application Security Verification Standard is a checklist of security requirements organized into 3 levels. It's not a pentest: a pentest tells you what's broken right now. ASVS tells you what you should be verifying continuously.

It's also not the same as SRB (Security Requirements Baseline). SRB defines the minimum security posture an organization mandates across all systems. ASVS is more granular: it's the verification checklist you use to prove you meet those requirements at the application level.

Think of it this way: SRB sets the policy, pentests find the holes, ASVS verifies the controls are actually in place.

The 3 Levels

Level 1: Opportunistic

All applications need this. It's the minimum bar, covering the OWASP Top 10: authentication, session management, input validation. If your app doesn't meet Level 1, you're leaving the front door open. Typical for SaaS MVPs, internal tools and marketing sites.

Level 2: Standard

Apps handling sensitive data need this level. It includes everything in Level 1, plus secure data storage, cryptography, error handling and API security. This is where most B2B SaaS and regulated apps should aim. Typical for healthcare (HIPAA), e-commerce, fintech and B2B SaaS.

Level 3: Advanced

High-value targets and regulated industries need this level. It includes everything in Level 2, plus advanced threat modeling, secure architecture review and defense-in-depth. It's reserved for systems where a breach has severe consequences. Typical for banking, government, critical infrastructure and defense.

Which Level Does Your Industry Need?

Quick Self-Assessment

Use this decision tree to find your level:

flowchart TD
    Start["Your Application"]
    Q1{"Handle PII, health data, or payment data?"}
    Q2{"Regulatory fines? Gov, defense, critical infra?"}
    Q3{"Internet-facing with user accounts?"}
    L1["Level 1: Baseline"]
    L2["Level 2: Standard"]
    L3["Level 3: Advanced"]

    Start --> Q1
    Q1 -->|"Yes"| Q2
    Q1 -->|"No"| Q3
    Q2 -->|"Yes"| L3
    Q2 -->|"No"| L2
    Q3 -->|"Yes"| L1
    Q3 -->|"No"| L1

Every production app should meet Level 1 at minimum. If you're not sure, you probably need Level 2.

Where Most Teams Go Wrong

Under-engineering: "We'll add security later." You won't. And when you do, it costs 10x more to retrofit than to build in.

Over-engineering: Spending 6 months on Level 3 controls for an internal tool that 12 people use. Match the investment to the risk.

Checkbox thinking: Treating ASVS as a one-time audit instead of an ongoing verification standard built into your development process.

Pentest-only security: A pentest once a year catches what's broken today. It doesn't verify that your authentication, cryptography, or session management are correctly designed. ASVS covers the architecture. Pentests validate the implementation.

The Bottom Line

ASVS isn't about perfection: it's about proportional security. Match your investment to your risk.

Most apps need Level 1. Most apps handling real user data need Level 2. If you're not sure, you probably need Level 2.