/asvs-reference

name: asvs-reference
description: >-
  Look up the right OWASP ASVS (Application Security Verification Standard) v5.0
  chapter and verification level (L1/L2/L3) for a control, requirement, or finding.
  Use when a design review, secure-code review, or pentest finding needs a
  consistent ASVS citation, or when scoping how deep a verification effort should go.

Goal

The correct ASVS chapter/requirement and verification level for a control or finding, cited consistently — so design reviews, secure-code reviews, and audits anchor to the same standard.

Steps

1. **Pick the verification level** by asset risk tier:

• **L1** — opportunistic/low-assurance apps; baseline controls only, testable

via black-box/automated checks.

• **L2** — most applications handling sensitive data (the default target for

most business apps).

• **L3** — high-value, high-assurance apps (financial, healthcare, critical

infra, regulatory mandate) — the full control set, deeper verification. 2. **Map the finding/control to the right ASVS chapter** — see `reference.md` for the chapter list. Cite the current ASVS chapter/requirement ID; don't hardcode a numbering you're not certain of — confirm against the live standard if precision matters (chapter numbering has shifted between ASVS editions). 3. **State the edition** — target **ASVS v5.0**; older reviews may cite v4.0.3, note the version if mixing. 4. **Hand off appropriately** — ASVS gives the control catalog; `security-architect: security-design-review` and `security-architect:secure-architecture-maturity` use it for design-time verification depth, `web-app-security`/`api-security` use it during testing.

Output

Chapter/requirement + verification level (L1/L2/L3) + one-line rationale for the level chosen. For control-maturity framing beyond a single finding, see `security-architect:secure-architecture-maturity` (SAMM).

Notes

ASVS is a **verification checklist**, not a maturity model — for "how mature is our security program" use OWASP SAMM instead (see `security-architect: secure-architecture-maturity`). Don't over-cite L3 requirements against an L1 asset; match level to actual risk. See `reference.md` for the chapter table and level criteria.