IT Audit Factory — evidence-first audit & compliance operations
Free • Professional • MSP
IT Audit Factory iconIT AUDIT FACTORYAudit, Evidence & Compliance Operations
Frameworks & Controls

OWASP MASVS / MASTG

24 source review items; explicit supporting and external test coverage

All available frameworks

What the app checks

Technical checks run for the selected scope, available connectors and credentials. Results provide evidence for review; missing data is not a pass.

No explicit technical test mapping is listed for this framework in the checked C32 mapping files. Use its evidence workpapers and manual review workflow; do not assume a scanner result covers these requirements.

Framework-specific tools and manual work

The workspace supplies 24 MASVS controls with active MASTG 2.0.0 procedure links and platform/status context. Deprecated tests are excluded. Testing the mobile app requires an authorized device/app environment and external or manual execution.

Review imported or exported evidence before attaching it to the assessment. Local inspection does not automatically change server records or assessor decisions.

What requires manual review

Confirm scope and applicability, review the requirement guidance, collect policies and records, conduct interviews or observations where needed, and assess evidence relevance and freshness. Record owners, rationale, workpaper conclusions and remediation. An assessor makes the final decision; a technical pass does not approve the whole framework.

Application-specific manual/external testing is required. Procedure maturity and platform are preserved; deprecated tests are excluded. Infrastructure scans do not establish mobile application security. OWASP MASVS 2.1.0 and MASTG 2.0.0, MASWE mapping pinned as of the MASTG release, OWASP Foundation and contributors. CC BY-SA 4.0 https://creativecommons.org/licenses/by-sa/4.0/. Adapted content packs are distributed under the same license. No OWASP endorsement.

Where it is available

This preparation framework is listed in the C32 Professional/MSP application catalog. Free retains its ISO assessment limits. Availability of a framework is separate from the extent of automated scanning.

Coverage shown here comes from the application’s C32 requirement and mapping catalogs.