Proving ASVS Alignment: Penetration Testing Evidence for Retail SaaS Vendors

Why are retail buyers asking SaaS vendors about ASVS alignment?

Retail buyers ask because a self-completed questionnaire tells them little. Large retailers and marketplaces increasingly name OWASP ASVS in vendor risk assessments, giving security teams a structured list of controls to check a supplier’s answers against, rather than free-text claims.

Retail is where this shows up first because ecommerce platforms sit directly in front of payment data and customer accounts, two things a retailer’s risk committee cares about long before code quality. A vendor already testing against ASVS control categories, rather than an ad hoc scope, answers those questionnaire lines faster and draws fewer follow-up questions from the buyer’s security team.

What does OWASP ASVS actually require, and what does it leave to the buyer?

ASVS sets out security requirements across authentication, session management, access control, input validation and API design, organised into three verification levels. It does not require a penetration test or any particular testing method; that choice is left to the organisation being asked to evidence it.

That distinction matters in a questionnaire response. Describing a platform as “ASVS-certified” invites a specialist reviewer to ask who issued the certificate, since OWASP ASVS is a community-maintained standard with no certification body attached. The defensible claim is that the platform has been tested against named ASVS control categories, at a stated level, by an independent tester, with a report available on request.

For retail SaaS vendors that touch cardholder data, there is a second reason the word “OWASP” turns up in security reviews: PCI DSS Requirement 11.4.1 requires a documented penetration testing methodology based on an industry-accepted approach, and names OWASP among the accepted approaches. That clause is about testing methodology, not the ASVS control checklist, so the two evidence different things: PCI DSS evidences how you tested, ASVS evidences what you tested for.

Which ASVS controls can a penetration test actually verify?

A penetration test can verify most ASVS Level 1 and Level 2 requirements directly, since they describe observable behaviour: session tokens after logout, cross-account access, and whether input validation stops injection. A few requirements, such as secure coding standards, need a process review too.

• Authentication and session management. Verified through manual testing of login flows, multi-factor authentication and how session tokens behave after logout or password reset.
• Access control and multi-tenancy. Verified by testing whether one retail customer’s account can reach another customer’s basket, orders or saved payment methods.
• Input validation and API design. Verified through an API penetration test of every endpoint the storefront or app calls, not only the ones in the published documentation.
• Data protection in transit and at rest. Verified through configuration review of TLS settings, storage encryption and key handling.

In our testing, the finding retail buyers most want ruled out sits in the second category: whether the multi-tenant model actually isolates accounts from one another. A test that only exercises the credentials you were given misses exactly that class of finding, which is why scope needs to name it explicitly rather than assume it is covered.

How do you turn an ASVS gap review into evidence a retail buyer accepts?

Start by mapping your platform’s features against the ASVS categories your buyer’s questionnaire names, then commission testing scoped to close the gaps that mapping finds. A generic report commonly fails to satisfy a retailer’s security team; they want one that states which ASVS areas were covered, and at what level.

A typical engagement runs in four stages. First, a scope call covers your platform’s architecture, tenant model and payment flows. Second, features are mapped against the ASVS Level 1 or 2 categories relevant to a retail buyer. Third comes manual, human-led testing of the web application and its APIs, since a scanner-only assessment misses most access-control and business-logic issues. Fourth, findings are written up against the ASVS category each one relates to, alongside standard severity ratings.

The evidence pack matters as much as the testing itself. Buyers increasingly want a signed independent attestation suitable for third-party security review, not a raw technical report with no summary a non-technical reviewer can act on. We build both into every ASVS-mapped engagement, so the same output answers the questionnaire and drives your own remediation backlog.

What does ASVS-aligned penetration testing cost for a retail SaaS platform?

A day of CREST-accredited testing typically costs £1,100 to £1,400 in the UK market. A single web application tested against ASVS Level 1 or 2 typically takes 4 to 6 days, so £4,400 to £8,400; adding the APIs the storefront calls takes it to 6 to 9 days, or £6,600 to £12,600.

Scope	Typical effort	Typical UK cost
Web application only, ASVS Level 1 or 2 mapping	4 to 6 days	£4,400 to £8,400
Web application plus API testing	6 to 9 days	£6,600 to £12,600
Full platform including cloud configuration review	8 to 12 days	£8,800 to £16,800
Retest after remediation	1 to 2 days	£1,100 to £2,800

These are typical UK market ranges, not a quote; the figure that ends up in your evidence pack comes from scoping your actual platform, tenant model and payment flows. For a wider view of how pricing is built up across engagement types, see our guide to penetration testing costs in the UK.

How EJN Labs approaches ASVS alignment evidence for retail SaaS vendors

EJN Labs is a UK CREST-accredited penetration testing firm, certified to ISO 27001 and Cyber Essentials Plus, and an IASME Certification Body for Cyber Essentials. All testing is delivered by UK-based testers working from your platform’s actual tenant model, rather than a generic web application penetration test checklist.

Every ASVS-related engagement starts with the mapping step described above, because a report that only lists CVSS scores rarely answers the question a retail buyer actually asked. Findings are written against the ASVS category they relate to, alongside standard API penetration test coverage, so one report supports both your questionnaire response and your own remediation backlog. For platforms selling through a marketplace as well as direct, our guide to SaaS penetration testing covers the wider evidence multi-tenant vendors get asked for.

Frequently Asked Questions

Does OWASP ASVS require a penetration test?

No. ASVS sets out security requirements to verify, and does not mandate a testing method; organisations choose how each gets verified. Many retail buyers now treat an independent penetration test mapped to ASVS categories as accepted evidence, since self-completed questionnaires carry little weight in procurement.

Why are we asked to confirm OWASP and NCSC aligned methodology?

Buyers use that phrase as shorthand for testing against recognised, published standards rather than an unstructured scan. NCSC guidance describes what a well-run penetration test looks like without naming ASVS specifically, so the safest response states your methodology and the ASVS categories it covers.

What ASVS level should a retail SaaS vendor test against?

Level 1 suits low-risk applications and covers baseline controls. Level 2 is what most retail buyers ask for once an application handles customer accounts, orders or payment data. Level 3 applies to payment processing cores. Where a questionnaire is silent on level, Level 2 is the safer default.

What does ASVS-aligned penetration testing evidence cost?

A web application test mapped to ASVS Level 1 or 2 typically takes 4 to 6 days at £1,100 to £1,400 per day, so £4,400 to £8,400. Adding the APIs your storefront calls takes it to 6 to 9 days, or £6,600 to £12,600. The exact figure depends on your tenant model and comes from scoping via the quote form.

How long does it take to get ASVS evidence ready for a retail procurement deadline?

Testing typically runs one to two weeks depending on scope, with the report delivered shortly after. Vendors working to a deadline should allow time for remediation and a retest, since any finding that contradicts a stated control needs fixing first. Starting four to six weeks ahead is a comfortable margin.

Get penetration testing evidence your retail buyers will accept

If a retail procurement questionnaire is waiting on ASVS evidence, we can scope a web application and API engagement mapped to the control categories your buyer named. Get a CREST pentesting quote and we will respond with a scoped fixed price for your platform.

Related research

For the wider evidence retail and SaaS suppliers get asked to produce, see our guides to SaaS penetration testing, ecommerce penetration testing and what PCI DSS 4.0 actually requires of UK retailers.