OWASP DevSecOps Verification Standard

OWASP DevSecOps Verification Standard - An OWASP incubator project

About OWASP DevSecOps Verification Standard

OWASP DevSecOps Verification Standard

The OWASP DevSecOps Verification Standard (DSOVS) is an open source framework that defines baseline requirements for any software project or organisation. You can use the DSOVS for:

💬 Connect with Us

#project-devsecops-verification-standard @realjvo (Jamieson Vincenti O'Reilly, Project Lead) @yudhiy (Yudhi Yudhistira, Project Lead)

🎉 Get Involved

Your contribution will help the DSOVS evolve as processes and technologies are ever changing. We welcome any kind of contribution and feedback to help make the DSOVS an even better open source project. Join our community today and be part of the journey For each phase, there are streams that the DSOVS assesses:## 📖 Table-of-Contents

Organisation Phase

🚧 ORG-001 Risk Assessment 🚧 ORG-002 Security Training 🚧 ORG-003 Security Champion 🚧 ORG-004 Security Reporting

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/ORG-001-Risk-Assessment.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/ORG-002-Security-Training.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/ORG-003-Security-Champion.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/ORG-004-Security-Reporting.md

Requirements Phase

🚧 REQ-001 Security Policy and Regulatory Compliance 🚧 REQ-002 Security Requirements and Standards 🚧 REQ-003 Security User Stories and Acceptance Criterias 🚧 REQ-004 Security Issues Tracking Design 🚧 DES-001 Security Architecture Design Reviews 🚧 DES-002 Threat Modelling

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REQ-001-Security-Policy-and-Regulatory-Compliance.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REQ-002-Security-Requirements-and-Standards.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REQ-003-Security-User-Stories-and-Acceptance-Criteria.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REQ-004-Security-Issues-Tracking.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/DES-001-Secure-Architecture-Design-Reviews.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/DES-002-Threat-Modelling.md

Code/Build Phase

🚧 CODE-001 Secure Development Environment ✅ CODE-002 Hardcoded Secrets Detection 🚧 CODE-003 Manual Secure Code Review 🚧 CODE-004 Static Application Security Testing (SAST) 🚧 CODE-005 Software Composition Analysis (SCA) 🚧 CODE-006 Software License Compliance 🚧 CODE-007 Inline IDE Secure Code Analysis 🚧CODE-008 Container Security Scanning 🚧 CODE-009 Secure Dependency Management

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-001-Secure-Development-Environment.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-002-Hardcoded-Secrets-Detection.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-003-Manual-Secure-Code-Review.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-004-Static-Application-Security-Testing-SAST.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-005-Software-Composition-Analysis-SCA.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-006-Software-License-Compliance.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-007-Inline-IDE-Secure-Code-Analysis.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-008-Container-Security-Scanning.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/CODE-009-Secure-Dependency-Management.md

Test Phase

🚧 TEST-001 Security Test Management ✅ TEST-002 Dynamic Application Security Testing (DAST) 🚧 TEST-003 Interactive Application Security Testing (IAST) 🚧 TEST-004 Penetration Testing 🚧 TEST-005 Security Test Coverage

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/TEST-001-Security-Test-Management.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/TEST-002-Dynamic-Application-Security-Testing-DAST.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/TEST-003-Interactive-Application-Security-Testing-IAST.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/TEST-004-Penetration-Testing.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/TEST-005-Security-Test-Coverage.md

Release/Deploy Phase

🚧 REL-001 Artifact Signing 🚧 REL-002 Secure Artifact Management 🚧 REL-003 Secret Management 🚧 REL-004 Secure Configuration 🚧 REL-005 Security Policy Enforcement 🚧 REL-006 Infrastructure-as-Code (IaC) Secure Deployment 🚧 REL-007 Compliance Scanning 🚧 REL-008 Secure Release Management

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-001-Artifact-Signing.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-002-Secure-Artifact-Management.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-003-Secret-Management.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-004-Secure-Configuration.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-005-Security-Policy-Enforcement.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-006-Infrastructure-as-Code-Secure-Deployment.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-007-Compliance-Scanning.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/REL-008-Secure-Release-Management.md

Operate/Monitor Phase

🚧 OPR-001 Environment Hardening 🚧 OPR-002 Application Hardening 🚧 OPR-003 Environment Security Logging 🚧 OPR-004 Application Security Logging ✅ OPR-005 Vulnerability Disclosure 🚧 OPR-006 Certificate Management 🚧 OPR-007 Attack Surface Management

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-001-Environment-Hardening.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-002-Application-Hardening.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-003-Environment-Security-Logging.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-004-Application-Security-Logging.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-005-Responsible-Disclosure.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-006-Certificate-Management.md

• https://github.com/OWASP/www-project-devsecops-verification-standard/blob/main/document/OPR-007-Attack-Surface-Management.md

Project Resources

Project Information

Incubator Project

Classification

Incubator

Corporate Supporters

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

Quick Links

Awards Chapters Community Contact Corporate Supporters Events Impact Report 2025 News Projects Staff Strategic Plan 2026 Visit Store

Legal & Governance

About OWASP Board Board EU Finance & Governance Finance (all documents)Legal

Socials

Bluesky GitHub LinkedIn Mastodon Slack X YouTube

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.