[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-573293-105":53,"doc-detail-573293-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","jim-manico-the-owasp-asvs-as-the-basis-for-a-security-program","Jim Manico - The OWASP ASVS as the basis for a security program","","Overview of OWASP Application Security Verification Standard, February 2019 update, authored by Jim Manico, including his OWASP roles and background. Frames OWASP as a worldwide not-for-profit focused on making software security risks visible and freely available. Discusses the OWASP Top Ten as an awareness resource, clarifying it is not a standard and is not comprehensive nor focused on remediation. Introduces OWASP ASVS 4.0 as a developer-driven application security standard, defining three risk levels and 200+ controls with a reference to ISO 27034.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/jim-manico-the-owasp-asvs-as-the-basis-for-a-security-program/573293/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/jim-manico-the-owasp-asvs-as-the-basis-for-a-security-program/573293.png","ImageObject",442,249,{"name":88,"@type":89},"nayy☆","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-16","2026-10-14",true,{"@type":98,"interactionType":99,"userInteractionCount":79},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is OWASP ASVS and why is it introduced in this document?","Question",{"text":108,"@type":109},"OWASP ASVS is presented as a developer-driven application security standard that can serve as a basis for a security program. It defines risk levels and a large set of controls for application security verification.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How does the document describe the OWASP Top Ten?",{"text":113,"@type":109},"The OWASP Top Ten is described as a security awareness document about web security issues. The document stresses it is not a standard, is not comprehensive, and does not provide detailed instructions to fix or prevent issues.",{"name":115,"@type":106,"acceptedAnswer":116},"What key capabilities does OWASP ASVS 4.0 provide?",{"text":117,"@type":109},"OWASP ASVS 4.0 is described as defining three risk levels and including 200+ controls. It is also noted as being similar to ISO 27034.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},573293,1792086995,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":79,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},962090893153,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","OWASP Application Security Verification  \nStandard  \nFebruary 2019 Update  \nJim Manico  \n• Former OWASP Board Member  \n• OWASP ASVS Lead Author  \n• OWASP Proactive Controls Lead Author  \n• OWASP Cheatsheet Series Project Manager  \n• Kauai, Hawaii Resident  \nAnalysis  \nOperations Design  \nTesting  \nImplementation  \nSecure  \nSDLC  \nCOPYRIGHT ©2019 MANICODE SECURITY  \nMicrosoft SDL for waterfall  \nMicrosoft SDL for Agile  \nThe Open Web Application Security Project (OWASP) is a  \n501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software .  \nOur mission is to make software security visible, so that individuals and organizations worldwide can make informed decisions about true software security risks .  \nEveryone is free to participate in OWASP and all of our materials are available under a free and open software license . You'll find everything about OWASP linked from our wiki and current information on our OWASP Blog.  \n[https://owasp.org](https://owasp.org)  \nThe OWASP Top Ten The Good  \n§ Project members include a variety of security experts from around the world who have shared their expertise to produce this list.  \n– Andrew van der Stock  \n– Neil Smithline  \n– Torsten Gigler  \n– Brian Glas  \n§ Significant public comments and conversation on Top  \nTen 2017 choices  \n[https://github.com/OWASP/Top10/tree/master/2017](https://github.com/OWASP/Top10/tree/master/2017)  \n§ Frequently cited application security awareness document  \nThe OWASP Top Ten Struggles  \n§ The OWASP Ten has a history of vendor shenanigans that dates back a decade .  \n§ The OWASP Top 10 list is meant to spread awareness regarding Web Security issues . It is not a standard. I'm looking at you PCI-DSS and others who incorrectly list it as so.  \n§ The OWASP Top Ten is not a comprehensive list of web security risks .  \n§ The OWASP Top Ten does not go into detail about how to fix or prevent these issues .  \nSo what standard can we use for web applications and webservice  \nsecurity?  \nOWASP ASVS 4.0!  \n§ First application security standard by developers for developers!  \n§ Defines three risk levels with 200+ controls .  \n§ Similar to ISO 27034  \n§ To be released in under 2 weeks!  \n§  [https://github.com/OWASP/A](https://github.com/OWASP/A)[SVS/tree/master/4.0/en](SVS/tree/master/4.0/en)","cbCaikDwO2IbOZg9","https://ap.wps.com/l/cbCaikDwO2IbOZg9","pdf",17858982,37,"English","# OWASP Application Security Verification Standard (February 2019 Update)\n## OWASP mission and open materials\n## OWASP Top Ten: purpose and limitations\n## OWASP ASVS 4.0 as a security program basis","[{\"question\":\"What is OWASP ASVS and why is it introduced in this document?\",\"answer\":\"OWASP ASVS is presented as a developer-driven application security standard that can serve as a basis for a security program. It defines risk levels and a large set of controls for application security verification.\"},{\"question\":\"How does the document describe the OWASP Top Ten?\",\"answer\":\"The OWASP Top Ten is described as a security awareness document about web security issues. The document stresses it is not a standard, is not comprehensive, and does not provide detailed instructions to fix or prevent issues.\"},{\"question\":\"What key capabilities does OWASP ASVS 4.0 provide?\",\"answer\":\"OWASP ASVS 4.0 is described as defining three risk levels and including 200+ controls. It is also noted as being similar to ISO 27034.\"}]","Jim Manico - The OWASP ASVS as the basis for a security program | PDF",1791936670,13]