What to look for
- 01
Use explicit requirements to agree what a security review will verify.
- 02
Select the applicable scope with someone responsible for your threat model.
Keep in mind
A requirements document is not evidence that an application is secure. Pin the version when writing a contract or verification plan.
Try this next
Take one sensitive application workflow and map its verification scope with the security owner before commissioning a review.
Get the security templateNotes and exercises by Awesome CTO. The original work belongs to OWASP ASVS contributors.
