GRCLibrary.ai

Standard

Mobile Application Security Standard

This standard defines the security controls applied to mobile applications the organization develops, publishes, or significantly customizes. It covers iOS and Android applications; mobile-web is governed by the API security standard plus the web-application standards in the dev-security domain.

Type
Standard
Version
1.1.8
Date
2026-09-23
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Developer Security
Review frequency
Annual and upon material change to mobile platforms, threat-pattern, or store-policy expectations
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Platform alignment
  • 4. Storage
  • 5. Cryptography
  • 6. Authentication and authorization
  • 7. Network communication
  • 8. Platform interaction
  • 9. Code quality and reverse-engineering resistance (MASVS-R)
  • 10. Third-party SDKs
  • 11. Store and distribution
  • 12. Privacy
  • 13. Testing
  • 14. Incident readiness
  • 15. Hybrid and cross-platform frameworks
  • 16. In-app purchases and receipt validation
  • 17. Operating expectations
  • 18. Framework alignment
  • 19. Limitations

Frameworks it maps to

Related documents