ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

The OWASP Application Security Verification Standard (ASVS) is specifically designed to provide developers, testers, and architects with a comprehensive, language-agnostic set of detailed and testable security controls for software, particularly web applications. ASVS organizes requirements by areas such as authentication, session management, access control, input validation, and cryptography, making it well suited for inclusion in Agile user stories and acceptance criteria.

NIST SP 800-53 and the CIS Critical Security Controls address broader organizational or system-level security controls rather than granular software-specific requirements. ISO/IEC 27001 defines an information security management system framework but does not supply the detailed application security requirements needed for day-to-day development tasks. Therefore, OWASP ASVS is the most appropriate choice for embedding concrete security requirements into the Agile development process.