Are there any web application security standards that I can use as a baseline for the security related requirements for a web application, web service, and for applications supported/hosted by third parties?

How is security risk managed for web application and what are the preventive and corrective controls that I should expect to see?

Additionally, how can we provide security compliance for web applications?

From my findings I found that most organizations have developed their own standards/guidelines like

Am I mistaken in that there is no universal standard?


3 Answers 3


In Austria we have a standard more or less written by SecConsult which is loosely based on OWASP documents. You can find more information on it here: http://www.a7700.org/index_e.html


From what I understand there is no 'universal' standard, however several standards do exist that you can use as a point of reference.

These are just a few I know about. The standards you build for yourself will be dictated by the nature of your application and the information is serves/stores. However the above resources should help you get an idea of what things you might want to keep in mind or work into your own standard.

  • There are also regulators like the FFIEC, Monetary Authority of Singapore (MAS), and others. These are generally at a process and procedure level, dealing with how an organization should run itself and its systems.
    – GdD
    Commented Nov 13, 2013 at 13:12

Depending on a specific use case (type of industry, country regulations etc.) a web application may be required to satisfy requirements from a variety of different standards. Some worth mentioning standards are the following:

  • OWASP Application Security Verification Standard 4.0.3
  • National Institute of Technologies Special Publication 800–218
  • International Organization for Standardization 27034
  • Center for Internet Security Critical Security Control 16: Application Software Security

Apart from formal standards you might want to take a look at projects like OWASP Top Ten or CWE/SANS Top 25.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .