OWASP AISVS v1.01: AI Security Verification Standard Across 12 Chapters and 214 Requirement Identifiers (213 Active)

A comprehensive engineering guide to the OWASP AI Security Verification Standard (AISVS v1.01), detailing 214 requirement identifiers across 12 chapters (C1 to C12), of which 213 are active because requirement 10.2.6 has been retired, assurance Levels 1 to 3, and Appendix C for AI-assisted secure coding. AISVS is a voluntary OWASP community standard, not a law or a certification scheme.

Overview

Target Audience: Organizations building, procuring, or operating LLM applications, RAG systems, autonomous agents, and MCP servers
Testing and Review Frequency: STH recommendation: pre-launch verification at Level 1, 2, or 3, and upon material changes to models, retrieval data, agent tools, or MCP servers, since AISVS sets no overall verification cadence
Assessment Scope: 214 requirement identifiers across 12 chapters (C1 to C12) covering data, models, infrastructure, vector DBs, agents, MCP, and Appendix C
Relevant Risks: Prompt injection, cross-tenant data leakage, unauthorized tool execution, and unverifiable AI security posture

OWASP AISVS v1.01 Structure and Verification Levels L1, L2, and L3

OWASP AISVS v1.01 defines testable security requirements for AI applications, and each assurance level is aligned with the matching ASVS level so the two standards are applied together at the same level.

OWASP AISVS 1.01: AI Security Verification Standard: Three verification levels (L1, L2, L3), Data, model, and infrastructure (C1-C8), Agents and MCP (C9-C10), Robustness and Appendix C (C11-C12) — **OWASP AISVS 1.01: AI Security Verification Standard**
213 active requirements across 12 chapters, plus Appendix C for AI-assisted coding
**Three verification levels (L1, L2, L3)**
L1 baseline, L2 sensitive or regulated data, L3 high assurance such as life safety and critical infrastructure
**Data, model, and infrastructure (C1-C8)**
Training Data, Input Validation, Model Lifecycle, Infrastructure, Access Control, Supply Chain, Model Behavior, and Memory
**Agents and MCP (C9-C10)**
37 Orchestration and Agentic Security requirements and 39 active MCP Security requirements
**Robustness and Appendix C (C11-C12)**
19 Adversarial Robustness and 21 Monitoring and Logging requirements, plus Appendix C for AI-assisted secure coding

Comprises 214 requirement identifiers organized into 12 chapters (C1 through C12), of which 213 are active because requirement 10.2.6 is marked as removed. They span training data integrity, model lifecycle, vector memory, agentic security, MCP security, and monitoring.
Level 1 (L1) is baseline security for any AI application that handles untrusted input or operates on data of any sensitivity.
Level 2 (L2) applies to AI applications handling sensitive business data or regulated data, or operating in adversarial contexts.
Level 3 (L3) is high assurance, for example for applications handling life-safety decisions, critical infrastructure, or highly sensitive personal data.

Chapters C1 to C6: Training Data, Input Validation, Model Lifecycle, Infrastructure, Access Control, and Supply Chain

Chapters C1 through C6 secure the foundational data pipelines, model artifacts, identity boundaries, and software supply chain.

C1 Training Data Integrity and Traceability (13 requirements) and C2 Input Validation (12) control the provenance and integrity of training data and the validation of untrusted input.
C3 Model Lifecycle Management (15) and C4 Infrastructure (14) cover model lifecycle control, signing, and secure runtime infrastructure. Requirement 4.1.2 requires model loading to use an explicit allow-list of serialization formats that do not permit arbitrary code execution during deserialization.
C5 Access Control and Identity (11) controls authentication and authorization across users, services, and the data a model can reach.
C6 Supply Chain Security for Models (7) covers model scanning before import, approved sources for weights, datasets, and adapters, artifact integrity, and an AI Bill of Materials (AIBOM).

Chapters C7 to C12: Model Behavior, Vector Memory, Agentic Security, and MCP Security

Chapters C7 through C12 contain the highest density of requirements, addressing RAG isolation, autonomous tool invocation, and Model Context Protocol integrations.

C7 Model Behavior (14) and C8 Memory, Embeddings, and Vector Database (11) govern model output behavior, tenant or namespace separation in RAG retrieval, and protection against poisoned memory.
C9 Orchestration & Agentic Security (37) governs agent controls such as approval gates, execution budgets, and circuit breakers for abnormal looping.
C10 MCP Security (40 identifiers, 39 active) is the largest chapter. It covers OAuth 2.1 token validation with per-call authorization, secure transport including Origin validation and sender-constrained tokens at the higher level, screening of tool definitions with re-approval when a definition changes, and a least-privilege sandbox for locally launched MCP servers.
C11 Adversarial Robustness (19) and C12 Monitoring and Logging (21) cover resilience against adversarial attacks and extraction, together with auditable logging and monitoring.

Appendix C (AI-Assisted Secure Coding) and Operationalizing AI Penetration Testing

Alongside the 12 core chapters, AISVS v1.01 includes Appendix C with 69 requirements in 14 families (AC.1 to AC.14) for AI-assisted software development.

Appendix C includes AC.4.2, which requires SAST, IAST, DAST, secret scanning, IaC scanning, and SCA on every pull request containing AI-generated code, and AC.13.3, which detects typosquatted dependency names and package references that resolve to no published version.
Offensive security teams pair AISVS v1.01 requirement IDs with the OWASP LLM Top 10:2026 and Agentic Top 10:2026 to turn threat categories into pass-or-fail verification test cases.
STH recommendation: use AISVS as a pre-launch acceptance reference and set a review cadence by risk, since AISVS sets no overall verification cadence (only AC.14.3 and AC.14.5 require testing at least once a year). AISVS places AI governance out of scope and points to ISO/IEC 42001, ISO/IEC 23894, and the NIST AI RMF for it.

References and Assessment Scope

Summary of source references, assessment scope, and review timing in the context of each item.

Reference	Topic	Assessment Scope	Testing Cycle
AISVS v1.01 Chapters C1 to C3 (40 Controls)	Training Data Integrity, Input Validation, and Model Lifecycle	Verify data provenance and integrity, validation of untrusted input, and model signing and lifecycle control	Pre-deployment and upon training data or fine-tuning changes
AISVS v1.01 Chapters C4 to C6 (32 Controls)	Infrastructure Hardening, Identity Access Control, and Supply Chain	Audit AI runtime infrastructure, identity and access control, serialization formats for model files (requirement 4.1.2), and AI Bill of Materials (AIBOM)	Scheduled security reviews and upon third-party model or dependency updates
AISVS v1.01 Chapters C7 to C10 (102 Identifiers, 101 Active)	Model Behavior, Vector DBs, Agentic Security (37), and MCP Security (40 identifiers)	Test RAG retrieval isolation, agent tool-execution controls, re-approval when a tool definition changes, and MCP server token validation	Pre-launch and whenever adding agent tools or MCP integrations
AISVS v1.01 Chapters C11 to C12 (40 Controls) and Appendix C	Adversarial Robustness, Telemetry, and AI Code Generation Security	Conduct AI red teaming against adversarial attacks and extraction, validate audit logs, and enforce Appendix C checks on AI-generated code	STH recommendation: align with L1, L2, or L3 assurance levels and continuous CI/CD checks

Implementation Checklist

Select items your organization has completed. The percentage shows selected items only and does not assess security or compliance.

Assign an AISVS assurance level (L1, L2, or L3) and maintain an AI Bill of Materials (AIBOM) under Chapters C1, C3, and C6. Separate untrusted inputs from instructions and enforce tenant-scoped vector database retrieval under Chapters C2, C5, and C8. Scope agent tool permissions, enforce human-in-the-loop approvals for sensitive actions, and cap execution budgets under Chapter C9 (37 controls). Validate OAuth 2.1 tokens and authorize every call, require re-approval when a tool definition changes, and run locally launched MCP servers in a least-privilege sandbox under Chapter C10 (40 identifiers). Execute adversarial robustness red teaming, validate runtime telemetry, and enforce Appendix C gates on AI-generated code.

Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

How many controls are in OWASP AISVS v1.01 and how are they structured?

OWASP AISVS v1.01 contains 214 requirement identifiers across 12 chapters (C1 to C12). Requirement 10.2.6 is retired, so 213 are active. The largest chapters are C10 MCP Security (40 identifiers, 39 active) and C9 Orchestration & Agentic Security (37), plus Appendix C with 69 requirements for AI-assisted secure coding.

How should an organization choose between AISVS Levels 1, 2, and 3?

Choose the level that matches the application. L1 is baseline security for any AI application that handles untrusted input or data of any sensitivity, L2 is for sensitive business data, regulated data, or adversarial contexts, and L3 is high assurance, for example life-safety decisions, critical infrastructure, or highly sensitive personal data. Each level assumes the matching ASVS level.

How does AISVS v1.01 complement the OWASP LLM and Agentic Top 10 lists?

While the LLM Top 10:2026 and Agentic Top 10:2026 identify top risk categories, AISVS v1.01 provides 214 granular requirement identifiers to test, remediate, and audit those risks systematically.