MASVS matters because it converts a vague request — "make sure the app is secure" — into a checkable list. When a report says the app meets MASVS-L1 across storage and network controls but fails two authentication controls, everybody involved knows exactly what was tested and what remains.
The current structure groups controls into categories: storage, cryptography, authentication and authorisation, network communication, platform interaction, code quality, and resilience against reverse engineering. The companion MASTG gives the actual test procedures, so results are reproducible by a second tester.
Level 1 suits most consumer apps. Level 2 adds defence-in-depth expectations appropriate for apps handling financial or health data. The resilience set is separate on purpose: obfuscation and anti-tampering are hardening measures for apps with a real reverse-engineering threat, and they never substitute for the core controls.
In short
- MASVS defines the controls; MASTG defines how to test them.
- L1 is the baseline for consumer apps; L2 for financial and health data.
- Resilience controls are additive hardening, not a replacement for L1.
- Ask any mobile test vendor for their MASVS coverage matrix.