OWASP TOP Ten is a ranking of critical threats to common Web applications that are published and periodically updated by the Open Worldwide Application Security Project (OWASP). The following table shows a mapping of the requirements specified in this standard to the 2021 version of the OWASP Top 10 which is fully covered by TSS-WEB.

OWASP Top Ten Control Relevant TSS-WEB Requirement
A01:2021-Broken Access Control Verification of every sensitive object access (on both functional and object layer) as well as the implementation of indirections (see section B.8 - Authorization).
A02:2021-Cryptographic Failures Covered in section B.10 - Data Security
A03:2021-Injection Primary: (1) Parametrization / ORM frameworks (SQL Injection) and (2) use of encoding APIs (see B.4 - Output Validation & Encoding. Secondary: restrictive input validation (see B.2 - Input Validation)
A04:2021-Insecure Design Covered in sections A.2.3 Secure Design and B.1 - Secure Design Principles
A05:2021-Security Misconfiguration Perform server hardening (see A.5.2 System Hardening)
A06:2021-Vulnerable and Outdated Components Keep your 3rd party components updates and perform SCA assessments in build pipeline. Covered in A.2.6 Securing Third-Party Dependencies.
A07:2021-Identification and Authentication Failures Covered in B.5 - Secure User Registration & Authentication and B.12 - API Security
A08:2021-Software and Data Integrity Failures Covered in B.10 - Data Security and A.2.5 Secure Build & Deployment
A09:2021-Security Logging and Monitoring Failures Covered in B.9 - Error Handling and Logging and A.5.8 Security Monitoring and Alerting
A10:2021-Server-Side Request Forgery Covered in B.2.1 General Requirements