OpenVAPTTracing Findings to Security Requirements
How to write security requirements that can be verified, and how standard identifiers link each finding back to the requirement it breaks.
OpenVAPT Academy handout. Online, with the self-check quiz: https://openvapt.com/academy/a8.html. Offline: openvapt learn A8.
Read First: A2
You Will Be Able To
- Write a security requirement that can be checked.
- Use OWASP ASVS, CIS Controls and NIST CSF identifiers to trace findings.
- Show coverage: which requirements were checked and which were not.
Requirements Come First
A test can only pass or fail against an expectation. Security work goes better when the expectations are written down before the system is built.
A good requirement is specific and checkable. Compare "the site must be secure" with "responses must not reveal the server version".
Traceability
Traceability links each requirement to the tests that check it and each finding to the requirement it breaks. It answers two questions: was this tested, and why does this matter?
Using Public Standards
Public standards give requirements stable identifiers. OWASP ASVS lists verifiable web application requirements, and CIS Controls and NIST CSF describe organisational safeguards.
OpenVAPT tags each check with these identifiers where a clear match exists, so a report can be sorted by requirement instead of by finding.
Coverage Is Not Completeness
A requirement with no check is not proven met. Reports should say which requirements were checked automatically and which still need a person to review.
In Summary
Write checkable requirements, link findings to them with standard identifiers, and be honest about which requirements no automated check covers.
Apply It
These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.
| Check | Title | Severity |
|---|---|---|
WEB-HDR-001 | Missing HTTP Strict Transport Security (HSTS) | Medium |
WEB-HDR-002 | Missing Content Security Policy | Medium |
WEB-HDR-003 | Site Can Be Framed (Clickjacking) | Medium |
WEB-HDR-004 | Missing X-Content-Type-Options | Low |
WEB-HDR-005 | Missing Referrer-Policy | Low |
WEB-HDR-006 | Missing Permissions-Policy | Low |
WEB-HDR-007 | Server Software Version Disclosed | Low |
Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.
Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.
Lab
Run: openvapt checks --json and list the web checks that carry an ASVS identifier.Rewrite three vague requirements from a project you know as specific, checkable statements.
Check Yourself
Answers are checked in your browser and never stored or sent.
References
Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.
Cite This Page
If this page helped your work, please cite it. The version and web address are filled in; the access date is today's date in your browser. Every other style, and when credit is required, is on How to Cite OpenVAPT.
OpenVAPT. (2026). A8: Tracing Findings to Security Requirements (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/a8.html
In text: (OpenVAPT, 2026). Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
@misc{openvapt_a8,
author = {{OpenVAPT}},
title = {{A8: Tracing Findings to Security Requirements}},
year = {2026},
howpublished = {\url{https://openvapt.com/academy/a8.html}},
note = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}
Accessed: the date shown is today's date from your own browser (the site's build date without JavaScript); change it to the day you read the page.
Citing OpenVAPT does not mean OpenVAPT endorses, approves or has reviewed your work.