What category of verification project this is
The OWASP Application Security Verification Standard (ASVS) defines security requirements for web applications and services. Teams use ASVS to design, develop, maintain, and verify application security against a chosen level. A requirement in ASVS must be verifiable. That verification ends in a pass or fail decision. ASVS is a requirements and verification project. ASVS is not a limited awareness Top 10 list.
ASVS is an industry verification project. ASVS is not a U.S. statute, and ASVS is not a certificate scheme.
A Top 10 checklist, an ASVS level, and the LLM Top 10 are three different objects.
Edition covered
The edition string for ASVS literacy is ASVS 5.0.0, dated May 2025. The version header states v5.0.0, released on May 30, 2025. The GitHub stable release tag is v5.0.0_release (2025-05-30). The official hubs are https://asvs.dev/ and https://github.com/OWASP/ASVS. On 2026-09-26, asvs.dev still listed Latest Stable Version 5.0.0. On that date, the GitHub releases page still listed v5.0.0_release as the stable release. A newer stable patch (5.0.1 or later) can appear. In that case, this pin must change, and the older claim is then UNKNOWN.
The master branch carries the unstable development version, not the stable pin. The GitHub release tagged latest was regenerated on 2026-09-03. That release states that the release is for test and preview use only. That release points production use to stable v5.0.0. asvs.dev cites patch 5.0.1 as the next release target. That patch is not a stable release yet. The unstable development tag is not ASVS 5.0.0.
L1, L2, and L3 are verification depth
ASVS 5.0.0 defines three verification levels, written L1, L2, and L3. Each higher level increases depth. The organization chooses a level from its own risk. ASVS does not prescribe one level for every application.
The same ASVS chapter describes the shares of the requirement set. Level 1 is a critical first step and contains around 20% of the requirements. Level 1 covers first-layer defenses against common attacks and gives a lower barrier to entry. The chapter advises most applications to strive to reach Level 2. L1 plus L2 together are around 70% of the requirements. Level 3 is the highest assurance goal. Level 3 adds the last share of the requirement set. Level 3 often covers defense in depth or harder controls. Those percentages are shares of the ASVS 5.0.0 requirement set. Those percentages are not adoption statistics.
The Level 2 advice is the ASVS characterization of Level 2, not a rule that every application must reach L3. A hallway Level badge is not evidence. Each team picks the verification depth that its risk needs and then gathers evidence for the controls that matter.
The theme first, then a verification depth
A Top 10 theme opens the conversation. The conversation then moves to verifiable requirements at a chosen ASVS level. Those requirements cover the controls that matter on that application. The Reference card already advises teams to use a requirements project such as ASVS for testable depth beyond awareness.
The OWASP Top 10 for LLM Applications 2026 is a separate awareness list (OWASP LLM Top 10 (2026): AI application risks). ASVS, Top 10:2025, and the LLM list stay separate.
Rewrite the one-line claim
The claim "we are Top 10, ASVS, LLM Top 10, and OWASP verified" mixes four objects. Exact replacement: "We use ASVS 5.0.0 as a leveled verification and requirements project." That use is different from OWASP Top 10:2025 awareness and from the LLM Top 10. It is also different from a finished application test.
A slide can state "OWASP verified" or "ASVS Level 2." The team then privately asks which edition, which level, and which application evidence was verified. The team also asks whether the live need is awareness (Top 10), verification depth (ASVS), or a separate LLM list.
Top 10 is not ASVS, not certified, and not Level N immune
| Phrase people use | Literacy correction |
|---|---|
| We checked the OWASP Top 10 boxes, so ASVS is done | OWASP Top 10:2025 is a limited awareness list. ASVS is a separate requirements and verification project with leveled depth. Explainer: /learn/explainers/owasp-top-10/. Reference card: /reference/frameworks/owasp-top-10-2025/. Six-map comparison: /reference/frameworks/compare/. |
| ASVS Level N done means the product is immune / secure forever | A level is a chosen verification depth against requirements. A level is not product immunity, not forever safety, and not proof that attackers will skip an application. |
| We are OWASP verified / ASVS certified | ASVS is not a mail-order seal. A seal is not evidence that a requirement was verified on the application. |
| ASVS done means LLM Top 10 done | The 2026 LLM list is its own awareness list for LLM applications. LLM list explainer: /learn/explainers/owasp-llm-top-10/. |
| ASVS is just another Top 10 poster | The Top 10 starts a conversation. ASVS is for testable requirements and verification depth. The Reference card already separates the two. Card: /reference/frameworks/owasp-top-10-2025/. Explainer: /learn/explainers/owasp-top-10/. |
| Every application must meet every ASVS requirement | Each level adds depth, and the organization picks the level that its risk needs. Only L3 holds the full requirement set. |
| Level badge on a vendor slide = our verification is finished | A vendor badge is not evidence that the application met the chosen requirements. The team asks which level, which edition, and which evidence. Practice stays on /learn/topics/shopcart-threat-model/ and /learn/topics/dependencies-and-transitive-risk/. Practice also stays on /learn/topics/pipeline-write-vs-promote/, /learn/topics/sbom-evidence-and-priority/, and /learn/topics/outcomes-then-controls/. |
Common misconceptions
Top 10 checkboxes mean ASVS is done, and OWASP certified.
The Top 10 is an awareness list. ASVS 5.0.0 is a separate requirements and verification project. Neither one is a certificate.
ASVS Level N means the product is immune, or secure forever.
A level is a chosen verification depth. A level does not make a product immune, and a level does not make a product safe forever.
ASVS, the Top 10, and the LLM Top 10 are the same thing.
The three are different objects. Top 10:2025 covers web risk themes. ASVS is leveled verification depth. The 2026 LLM list covers LLM applications.
ASVS Level 1 is the target for every application.
Level 1 is a critical first step. ASVS advises most applications to strive for Level 2, and the organization chooses the level from its own risk.
A vendor homepage shield attests ASVS completion.
A homepage shield is not evidence that a requirement was verified on the application.
The GitHub release tagged latest is the ASVS version for production.
That release is for test and preview use only. Production use points to the stable v5.0.0 release.
L1, L2, and L3 by share of the requirement set
The level strip comes from ASVS 5.0.0 (What is the ASVS?).
| Level | ASVS 5.0.0 description | Boundary |
|---|---|---|
| L1 | Minimum requirements and a critical first step. Around 20% of the requirements. First-layer defenses against common attacks. A lower barrier to entry. | A first set. Not the whole standard, and not immunity. |
| L2 | The level that ASVS advises most applications to strive to reach. L1 plus L2 are around 70% of the requirements. | The ASVS characterization of L2. Not a rule that every application must reach L3, and not immunity. |
| L3 | Highest assurance goal. Level 3 adds the remaining requirements, around 30%. Often defense in depth or harder controls. | A chosen depth. Not a rule that most readers must be L3, and not immunity. |
CHECK THE CATEGORY
Which sentence matches ASVS literacy?
Glossary and nearby pages
- OWASP Top 10 explainer (awareness list)
- OWASP Top 10 Reference card (framework summary)
- Compare the six maps (a row is not this project)
- Map the shop: trust boundaries on a synthetic checkout API (A1)
- What the team did not import still ships with the build (A2)
- Who can write, who can promote (A3)
- An SBOM is inventory, not a control (A4)
- Outcomes first, then controls (F8a)
- Application and software supply-chain path
- OWASP GenAI LLM Top 10 2026 explainer (awareness list, not this project)
- NIST AI RMF 1.0 explainer (voluntary framework, not this project)
- NIST SSDF Version 1.1 explainer (software practice vocabulary, not this project)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.