Application Security (ASVS 5.0)
345 verification questions across the seventeen chapters of ASVS 5.0, scored per requirement.
345 controls · 17 pillars · 80 categories · evidence can be collected automatically
345 verification questions across the seventeen chapters of ASVS 5.0, scored per requirement.
345 controls · 17 pillars · 80 categories · evidence can be collected automatically
Software you build, commission or inherit through an acquisition is examined against the open verification standard the industry has settled on, requirement by requirement, and scored. The decision it supports is a concrete one — whether to accept a release, a supplier or a purchase — because an application nobody has verified this way is an unquantified liability sitting between your customers and their data. Where you take payments, hold patient records or process personal data under UK GDPR, the duty to assure that software is yours whether you wrote it or bought it.
345 questions across 17 chapters and 80 categories, run per application rather than per organisation, and scored one requirement at a time. The chapters are independent, and that is the budget lever: a headless API with no browser surface skips V3 and V17, which is 43 questions, while a consumer login flow spends most of its time in V6 and V10, which is 83. It fits a release calendar better than an annual one, because after a change you rescore the chapters that change touched instead of all 345.
V1 and V2 go at output encoding, injection sinks, deserialisation and whether input is canonicalised once and before validation rather than after; V3 at cookie attributes, origin separation, subresource integrity and the browser mechanisms the application declares a dependency on. V10's 36 questions split the OAuth client, resource server and authorisation server roles and interrogate each separately, including consent handling, which is where most implementations turn out to be thin, while V9's seven cover tokens the application signs and then trusts itself. V11 asks for a cryptographic inventory and then checks algorithm, hashing, random value and in-use data choices against it; evidence throughout is code, configuration and a walkthrough with the developers who wrote it, not a scanner report pasted into a template.
345 controls across 17 pillars and 80 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
An assessor works each chapter with the development team, reading source, configuration, dependency manifests and deployment settings, and records a score with the artefact that justified it against every requirement. A read-only collector answers 24 of the 345 requirements - the scaffolding around the code and the headers a running endpoint actually sends, from a GitHub or Azure DevOps repository and a single HTTPS request - and each one arrives as a suggestion rather than an answer. The rest cannot be collected, because no amount of repository metadata establishes what an application does with a request.
Verification establishes that a defence is present and correctly constructed; it cannot establish that no exploitable bug remains, which is what a penetration test is for and why the two are usually bought together.
Bespoke operational software is rarely verified against anything external, and this gives a supplier an acceptance bar that is a scored artefact rather than a signed statement.
Citizen-facing services stand or fall on authentication and delegated authorisation, which is V6 and V10 — 83 of the 345 questions between them.
Session handling, self-signed token validation and operation-level authorisation need verifying independently of one another, which is what V7, V9 and V8 do instead of treating access control as a single control.
File upload, storage and download handling is where patient documents and coursework leak, and V5's 13 questions are the chapter teams most often assume someone else covered.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is extensive at 345 controls.
£6,500
Per engagement, excluding VAT.
£16,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.