Are there any web application security standards that I can use as a baseline for the security related requirements for a web application, web service, and for applications supported/hosted by third parties?

How is security risk managed for web application and what are the preventive and corrective controls that I should expect to see?

Additionally, how can we provide security compliance for web applications?

From my findings I found that most organizations have developed their own standards/guidelines like

Am I mistaken in that there is no universal standard?

  • Are there any web application security standards? based on some reports, it seems there are no standards.
    – mah
    Nov 12, 2013 at 21:18

3 Answers 3


In Austria we have a standard more or less written by SecConsult which is loosely based on OWASP documents. You can find more information on it here: http://www.a7700.org/index_e.html


From what I understand there is no 'universal' standard, however several standards do exist that you can use as a point of reference.

These are just a few I know about. The standards you build for yourself will be dictated by the nature of your application and the information is serves/stores. However the above resources should help you get an idea of what things you might want to keep in mind or work into your own standard.

  • There are also regulators like the FFIEC, Monetary Authority of Singapore (MAS), and others. These are generally at a process and procedure level, dealing with how an organization should run itself and its systems.
    – GdD
    Nov 13, 2013 at 13:12

For financial organizations, PCI compliance is a must.

Also, take a look at the ISO 27000 series.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.