Security Requirements Specification Template (OWASP ASVS 5.0)

Security Requirements Specification: [Application name]

Security requirements for one application, selected by OWASP Application Security Verification Standard (ASVS) level and organised by ASVS chapter, with abuse cases that show what each group of requirements defends against. It is based on OWASP ASVS 5.0.0 (released 30 May 2025), which groups about 350 requirements into 17 chapters and three levels. Requirement numbers are cited in the version-tagged form ASVS recommends (v5.0.0-<chapter>.<section>.<requirement>); the requirement statements in this template are original paraphrases. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Target verification level
3. Context and security documentation
4. Requirements by ASVS chapter
5. Abuse cases
6. Project-specific security requirements
7. Verification approach
8. Traceability
9. Exceptions and risk acceptance
10. Glossary and references

1. Purpose and scope

This specification states the security requirements that [Application name] must meet for [release]. It is the reference for design, implementation, security testing and acceptance.

Example: The Brindlecote Clinics patient booking portal (a fictional healthcare provider) lets patients book, move and cancel appointments, upload referral letters and read appointment letters. It has a web front end, a public REST API used by a mobile app, and an administration area for clinic staff.

2. Target verification level

Target: [Level], because [reason]. Chapters raised above or lowered below the target level are listed in the table in section 4.0 with the reason.

Example: Level 2 overall, because the portal handles health-related personal data and is internet-facing. V6 Authentication for staff accounts is raised to Level 3 for the requirement on hardware-based, phishing-resistant factors, because staff can see every patient's bookings.

Level overview (from the ASVS 5.0.0 introduction, paraphrased): Level 1 holds roughly 20% of the requirements and covers first-layer defences; Level 2 adds roughly 50% more, so a Level 2 application meets about 70% of the requirements; Level 3 adds the final 30% or so, mostly defence in depth and harder controls.

3. Context and security documentation

4. Requirements by ASVS chapter

4.0 Chapter applicability

4.1 V1 Encoding and Sanitization

4.2 V2 Validation and Business Logic

4.3 V5 File Handling

4.4 V6 Authentication

4.5 V7 Session Management

4.6 V8 Authorization

4.7 V11 Cryptography and V12 Secure Communication

4.8 V13 Configuration and V14 Data Protection

4.9 V16 Security Logging and Error Handling

4.10 Remaining chapters

[Add tables for V3 Web Frontend Security, V4 API and Web Service, V9 Self-contained Tokens, V10 OAuth and OIDC and V15 Secure Coding and Architecture in the same format, or state why a chapter does not apply. Use the ASVS 5.0.0 text on GitHub for the full list of requirements per level.]

5. Abuse cases

The sequence below shows abuse case AC-03 and the controls that stop it.

6. Project-specific security requirements

Data protection duties depend on jurisdiction. As dated examples (checked 2026-10-30): in the EU, Article 32 (security of processing) of the GDPR, Regulation (EU) 2016/679, https://eur-lex.europa.eu/eli/reg/2016/679/oj; in the UK, the UK GDPR together with the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, https://www.legislation.gov.uk/ukpga/2018/12; in the US, for HIPAA covered entities and business associates, the Security Rule in 45 CFR Part 164, Subpart C (sections 164.302 to 164.318), https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C. This is not legal advice; check the current official text and a qualified professional.

7. Verification approach

8. Traceability

Keep the project-wide links in requirements/traceability-matrix.

9. Exceptions and risk acceptance

10. Glossary and references

10.1 Glossary

10.2 References

Standard and licence note

Based on the OWASP Application Security Verification Standard (ASVS) version 5.0.0, released 30 May 2025 by the OWASP Foundation under the Creative Commons Attribution-ShareAlike 4.0 International licence (CC BY-SA 4.0), https://asvs.owasp.org/. This template cites ASVS chapter and section names, requirement numbers and levels, and paraphrases the level descriptions and requirements in original wording; it does not copy ASVS requirement text. If you paste ASVS requirement text into your copy, that material remains under CC BY-SA 4.0: attribute OWASP, link the licence, state any changes, and share your adaptation of it under the same licence. Check the current ASVS release before use, as requirement numbers change between versions. The laws named in section 6 are dated examples only. Template licence: MIT.