Here's a way to do it. Each call to \boldAcr adds an item to a seq variable that contains the acronym and the meaning. At the \end of the defined environment the seq var is sorted (using code from this answer -- same caveats apply) then printed using \boldAcroPut, which is the same as you defined previously.

\documentclass{article}
\usepackage{xparse}
\newlength{\boldAcrwidth}
\setlength{\boldAcrwidth}{2cm}
\ExplSyntaxOn
\cs_if_exist:NTF \__str_if_eq:nn
{ \cs_new_eq:NN \sctale_str_if_eq:nn \__str_if_eq:nn } % TexLive 2018 onwards
{ \cs_new_eq:NN \sctale_str_if_eq:nn \__str_if_eq_x:nn } % Previous versions (TeXLive 2017 at least)
\cs_generate_variant:Nn \sctale_str_if_eq:nn { oo }
\cs_new:Npn \__sctale_acro:w #1 \q_mark #2 \q_stop {#1}
\seq_new:N \l__sctale_acro_seq
\NewDocumentEnvironment { acroenv } { }
{ \seq_clear:N \l__sctale_acro_seq }
{
\seq_sort:Nn \l__sctale_acro_seq
{
\int_compare:nNnTF
{
\sctale_str_if_eq:oo
{ \__sctale_acro:w ##1 \q_stop }
{ \__sctale_acro:w ##2 \q_stop }
}
< 0
{ \sort_return_same: }
{ \sort_return_swapped: }
}
\seq_map_function:NN \l__sctale_acro_seq \__sctale_put_acro:n
}
\cs_new:Npn \__sctale_put_acro:n #1 { \__sctale_put_acro:w #1 \q_stop }
\cs_new:Npn \__sctale_put_acro:w #1 \q_mark #2 \q_stop
{ \boldAcroPut{#1}{#2} }
\NewDocumentCommand { \boldAcr }{ m >{\SplitList{~}} m }
{ \seq_put_right:Nn \l__sctale_acro_seq { #1 \q_mark {#2} } }
\ExplSyntaxOff
\NewDocumentCommand{\boldAcroPut}{mm}{%
\noindent
\makebox[\boldAcrwidth][l]{\bfseries\textit{\MakeUppercase{#1}}}%
\ProcessList{#2}{\boldAcrFirst}%
\unskip\par%
}
\NewDocumentCommand{\boldAcrFirst}{m}{%
\boldAcrFirstAux#1 % we want a space
}
\NewDocumentCommand{\boldAcrFirstAux}{m}{%
\textbf{\MakeUppercase{#1}}%
}
\begin{document}
\begin{acroenv}
\boldAcr{owasp}{open web application security project}
\boldAcr{asvs}{application security verification standard}
\boldAcr{dbms}{database management system}
\boldAcr{sqlia}{structured query language injection attack}
\boldAcr{ldap}{lightweight directory access protocol}
\end{acroenv}
\end{document}
Replacing the definition of \boldAcr with this:
% \NewDocumentCommand { \boldAcr }{ m >{\SplitList{~}} m }
% { \seq_put_right:Nn \l__sctale_acro_seq { #1 \q_mark {#2} } }
\cs_new_eq:NN \dont \prg_do_nothing:
\NewDocumentCommand { \boldAcr }{ >{\SplitList{~}} m }
{
\tl_set:Nx \l__sctale_tmpa_tl { \tl_map_function:nN {#1} \__sctale_make_acro:n }
\seq_put_right:No \l__sctale_acro_seq { \l__sctale_tmpa_tl \q_mark {#1} }
}
\cs_new:Npn \__sctale_make_acro:n #1 { \__sctale_make_acro:w #1 \q_nil }
\cs_new:Npn \__sctale_make_acro:w #1 #2 \q_nil
{ \token_if_eq_meaning:NNF #1 \dont { #1 } }
you spare yourself the hassle of writing the acronym. To avoid a word being used in the acronym you just tell it to \dont use it:
\begin{acroenv}
\boldAcr{open web application security project}
\boldAcr{application security verification standard}
\boldAcr{database management system}
\boldAcr{structured query language injection attack}
\boldAcr{lightweight directory access protocol}
\boldAcr{national oceanic \dont{and} atmospheric administration}
\end{acroenv}

\addacr{owasp}{open web application security project}and add any acronym and then have a\printacrlistthat automatically sorts them. But may be there's a package already made for acronyms? – Manuel Feb 13 '19 at 12:15