---
title: "A8: Tracing Findings to Security Requirements"
canonical: https://openvapt.com/academy/a8.html
html: https://openvapt.com/academy/a8.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# A8: Tracing Findings to Security Requirements

How to write security requirements that can be verified, and how standard identifiers link each finding back to the requirement it breaks.

- Level: Applied
- Time: about 20 minutes
- Read first: A2

## You Will Be Able To

- Write a security requirement that can be checked.
- Use OWASP ASVS, CIS Controls and NIST CSF identifiers to trace findings.
- Show coverage: which requirements were checked and which were not.

## Requirements Come First

A test can only pass or fail against an expectation. Security work goes better when the expectations are written down before the system is built.

A good requirement is specific and checkable. Compare "the site must be secure" with "responses must not reveal the server version".

## Traceability

Traceability links each requirement to the tests that check it and each finding to the requirement it breaks. It answers two questions: was this tested, and why does this matter?

## Using Public Standards

Public standards give requirements stable identifiers. OWASP ASVS lists verifiable web application requirements, and CIS Controls and NIST CSF describe organisational safeguards.

OpenVAPT tags each check with these identifiers where a clear match exists, so a report can be sorted by requirement instead of by finding.

## Coverage Is Not Completeness

A requirement with no check is not proven met. Reports should say which requirements were checked automatically and which still need a person to review.

## In Summary

Write checkable requirements, link findings to them with standard identifiers, and be honest about which requirements no automated check covers.

## Apply It

- [WEB-HDR-001 Missing HTTP Strict Transport Security (HSTS)](https://openvapt.com/checks/WEB-HDR-001.md) (medium)
- [WEB-HDR-002 Missing Content Security Policy](https://openvapt.com/checks/WEB-HDR-002.md) (medium)
- [WEB-HDR-003 Site Can Be Framed (Clickjacking)](https://openvapt.com/checks/WEB-HDR-003.md) (medium)
- [WEB-HDR-004 Missing X-Content-Type-Options](https://openvapt.com/checks/WEB-HDR-004.md) (low)
- [WEB-HDR-005 Missing Referrer-Policy](https://openvapt.com/checks/WEB-HDR-005.md) (low)
- [WEB-HDR-006 Missing Permissions-Policy](https://openvapt.com/checks/WEB-HDR-006.md) (low)
- [WEB-HDR-007 Server Software Version Disclosed](https://openvapt.com/checks/WEB-HDR-007.md) (low)

## Lab

1. `Run: openvapt checks --json and list the web checks that carry an ASVS identifier.`
2. `Rewrite three vague requirements from a project you know as specific, checkable statements.`

## Check Yourself

Answer keys are public for every channel (see Teaching With OpenVAPT).

1. Which requirement can be verified?
   - A. The site must be secure
   - B. Responses must not reveal the web server version
   - C. Security is a priority
   - D. Hackers must be stopped
   - Answer: B. A specific, observable statement can pass or fail.

2. What does traceability link?
   - A. Servers to cables
   - B. Requirements to tests and findings to requirements
   - C. Users to passwords
   - D. Logs to backups
   - Answer: B. Traceability shows what was tested and why a finding matters.

3. What is OWASP ASVS?
   - A. A firewall product
   - B. A list of verifiable web application security requirements
   - C. A programming language
   - D. A certificate authority
   - Answer: B. ASVS gives each web security requirement a stable identifier.

4. A requirement has no matching check. What should a report say?
   - A. That it passed
   - B. That it was not checked automatically and needs review
   - C. Nothing
   - D. That it failed
   - Answer: B. Unchecked is not the same as met. Honest reports show the gap.

5. Why tag checks with standard identifiers?
   - A. To make reports longer
   - B. So findings can be grouped by requirement and compared across tools
   - C. To hide the check name
   - D. Because the law requires one standard
   - Answer: B. Shared identifiers let teams map results to the requirements they follow.

## Key Terms

- Traceability: Links between requirements, the tests that check them and the findings that break them.
- Verification: Confirming that a fix actually removed the weakness.
- Evidence: The observed data, such as a configuration line, that supports a finding.

## References

- [OWASP Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/)
- [CIS Critical Security Controls](https://www.cisecurity.org/controls)

Offline: `openvapt learn A8`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/a8.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.