What it covers. The ASVS is an OWASP standard that lists security requirements for designing, building and testing web applications and services. Requirements are grouped by area, such as authentication, session management, access control, input handling, cryptography and logging, and assigned to three levels of increasing rigour so that organisations can match verification depth to the application's risk.
In practice. Organisations pick a target level per application, use ASVS requirements as security acceptance criteria and as a basis for testing scope, and track compliance over time. Evidence includes requirement mappings, test results that reference ASVS identifiers and documented exceptions. It can also be used to set expectations in contracts with development suppliers.
Common gaps. Teams sometimes claim a level without verifying each requirement. Version differences also cause confusion, so requirement identifiers should always be cited with the version used.