I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list myself, but I am hoping there is something standardised, something independent of me that my client and the users of our site will appreciate more than just something I compiled.

1 Answer 1


It sounds like you might be looking for something like the OWASP ASVS. It defines four levels of rigor, each of which has an associated set of verification activities. Once a client has decided the level at which their application should reside, you will have a concrete list of security activities that should be performed to get to that level.

  • Very interesting looking project. Lots of reading for me.
    – ProfK
    Feb 17, 2012 at 12:49

You must log in to answer this question.