OWASP MASVS (Mobile Application Security Verification Standard), explained

The OWASP Mobile Application Security Verification Standard (MASVS) is, in OWASP's own words, "a comprehensive security standard" providing "a clear and concise set of guidelines and best practices for assessing and enhancing the security of mobile applications." It is maintained by the OWASP Mobile Application Security (MAS) project and is fully open — unlike some OWASP standards, there is no paywalled edition. OWASP frames it as usable three ways: as a metric for scoring an app's security posture, as guidance during development, and as a baseline for procurement.

Eight control categories

OWASP's "Using the MASVS" page defines eight control groups, each labelled MASVS-XXXXX:

Category	What it covers
MASVS-STORAGE	Secure storage of sensitive data on a device (data-at-rest)
MASVS-CRYPTO	Cryptographic functionality used to protect sensitive data
MASVS-AUTH	Authentication and authorization mechanisms used by the mobile app
MASVS-NETWORK	Secure network communication between the app and remote endpoints (data-in-transit)
MASVS-PLATFORM	Secure interaction with the underlying mobile platform and other installed apps
MASVS-CODE	Security best practices for data processing and keeping the app up-to-date
MASVS-RESILIENCE	Resilience to reverse engineering and tampering attempts
MASVS-PRIVACY	Privacy controls to protect user privacy

Each group breaks down further into individual controls labelled MASVS-XXXXX-Y (for example MASVS-STORAGE-1), which the companion testing guide maps to concrete test procedures.

MAS Profiles: L1, L2, R, and P

The project "traditionally provided three verification levels (L1, L2 and R)," which OWASP states were "revisited during the MASVS refactoring in 2023, and the MASWE refactoring in 2026" and reworked into what it now calls MAS Profiles:

• MAS-L1 — a baseline "for the most fundamental security requirements and best practices that every mobile app should meet," assuming the OS itself can be trusted (device not rooted/jailbroken) and that other apps, not the primary user, are the adversary. Recommended for all mobile apps as a floor.
• MAS-L2 — adds controls for apps handling highly sensitive data, such as those needing to "demonstrate compliance with standards and regulations such as PCI DSS, the Gramm-Leach-Bliley Act, and the Sarbanes-Oxley Act."
• MAS-R — anti-tampering and anti-reverse-engineering controls, explicitly meant "to augment and not replace MAS-L1 and MAS-L2," for apps protecting business logic (OWASP's example: competitive games defending against cheating). OWASP is candid that these controls "cannot assure a 100% effectiveness" since a reverse engineer with full device access will eventually succeed given enough time.
• MAS-P — a privacy baseline for apps handling user-sensitive data, designed to work alongside L1/L2 rather than stand alone.

OWASP frames profile selection as "a risk-based decision made in consultation with business owners," not a checklist every app must clear in full — the standard explicitly expects apps to adopt only the profiles that match their actual threat model.

MASTG and MASWE: the companion pieces

MASVS states what to verify; it doesn't say how. Two companion resources fill that in: the OWASP Mobile Application Security Testing Guide (MASTG) "describes the technical processes for verifying the controls listed in the MASVS," with separate Android and iOS test procedures per control, and MASWE (Mobile Application Security Weaknesses) is a parallel enumeration of specific weaknesses (for example, MASWE-0001, "Sensitive Data Stored Unencrypted in Private Storage") mapped back to the MASVS control they violate. OWASP is explicit that the MASVS only covers the mobile app's client side — testing a backend endpoint the app talks to falls to the OWASP ASVS instead.

The current release is v2.1.0, published 18 January 2024 on the OWASP/masvs GitHub repository, which added the MASVS-PRIVACY category. The named authors are Sven Schleier, Carlos Holguera, Jeroen Beckers, Bernhard Mueller, and Jeroen Willemsen; OWASP licenses the work under Creative Commons Attribution-ShareAlike 4.0. OWASP is also explicit about one limit on the standard's authority: it "does not certify any vendors, verifiers or software" — a third party claiming "MASVS-certified" status is making its own claim, not an OWASP-issued one.

Where this fits for device makers

A growing share of IoT and industrial products ship with a companion mobile app for setup, monitoring, or firmware updates — and that app is frequently the weakest link in an otherwise hardened device, since it's built on a separate codebase and release cycle from the firmware itself. Teams already assessing firmware against frameworks like IEC 62443-4-2 or scanning for CWE Top 25 weaknesses in embedded code can use MASVS as the matching baseline for the app side: MAS-L1 as a minimum bar for any companion app, MAS-L2 if it handles payment or health data, and MAS-R if the app enforces licensing or anti-cheat logic worth protecting.

SoftWSP's device and firmware assessments can extend to a product's companion mobile app, checking it against MASVS categories like storage and network communication rather than leaving the app as an unassessed gap next to a hardened firmware image: see device & firmware security services.

This guide summarises a public OWASP publication; it does not constitute legal or compliance advice.