What do you guys think about this?  I have added what I thought was relevant from the OWASP ASVS for Level 1 applicatiosn.  I included very few Level 2 requirements.