Google CASA 2026: Complete Guide to Cloud Application Security Assessment

• CASA is Google’s new security audit framework for cloud apps that handle sensitive Google user data. It’s built on the OWASP ASVS standard and uses risk based, multi tier testing Tier 1- 3 to ensure apps follow strong security controls.
• Apps accessing restricted scopes e.g. Gmail or Drive APIs must pass a CASA audit by a Google approved lab, then revalidate yearly. Tier 3 is the highest level lab verified and required for Google Workspace Marketplace badges.
• Typical assessment costs range from a few hundred to a few thousand dollars per year depending on tier. Authorized labs TAC Security, Leviathan, DEKRA, etc. handle the testing, reporting a Letter of Validation LOV to Google.
• Why it matters in 2026: With rising privacy regulations and Google's strict OAuth policies, CASA compliance is now mandatory for apps that need wide Google data access. Failing to pass CASA can block your app's approval or Google integration.

Updated: September 2026. Reflects the App Defense Alliance now operating under the Linux Foundation, the shift from Tiers 1 to 3 to Assurance Levels, the CASA Accelerator, and annual recertification.

Google CASA at a Glance

The one line to remember: CASA is not optional for restricted-scope apps, it is the price of continued access to Google user data, and it comes due every year.

What Is Google CASA?

Google's Cloud Application Security Assessment (CASA) is a standardized security review for cloud apps, created by the App Defense Alliance (ADA), an industry group whose founding members include Google. The ADA has since moved under the Linux Foundation, making it a neutral, community-run standard rather than a single vendor's checklist, and the requirements are now maintained as CASA v2 by ADA's Application Security Assessment Working Group. In practice, CASA is a security audit framework built on the OWASP ASVS (Application Security Verification Standard), 100 percent, with no proprietary requirements of its own.

It defines a consistent set of baseline controls access control, architecture, cryptography, etc. that any Google integrated app must meet. CASA uses a risk based, multi tier approach: apps are classified by user count, OAuth scopes, data sensitivity, etc., and then tested accordingly.

Practically, CASA serves as a high assurance pentest for cloud apps. A Google empaneled lab performs a time limited, functional audit of your app’s externally accessible interfaces. This means the lab will do DAST dynamic analysis, review code SAST, and other checks but only on the app layer, not the cloud infrastructure.

The goal is to show that your app handles Google data securely and can promptly delete it on request.

Figure: Google Workspace Marketplace shows an Independent security verification badge on apps that passed a Tier 3 CASA audit.

Why CASA Matters in 2026

User trust and compliance Google now requires CASA for any app that requests restricted OAuth scopes those that provide broad access to Gmail, Drive, Calendar, Contacts, and other sensitive data.

In Google’s words, apps accessing restricted data… must undergo an annual security assessment by a Google approved third party. For U.S. SaaS vendors handling Google user data at scale, CASA is mandatory.

The stakes are high. Apps passing Tier 3 CASA earn a coveted security verification badge in the Google Workspace Marketplace. This badge signals to customers that the app has been rigorously audited.

In contrast, apps failing CASA may be denied API access or removed from listings. With the ongoing tightening of data privacy rules and Google's OAuth policies, CASA compliance is now a go/no go for Google integrations. It's especially critical for enterprise or SaaS vendors who live and die by API trustworthiness.

Standardization and industry alignment CASA fills a big gap. Over the past decade, cloud infrastructure security has improved dramatically but application layer security still lags.

By aligning with OWASP ASVS and sponsoring a tiered framework, Google and the ADA are pushing the industry toward a common standard for app security.

Knowing CASA means you're on the forefront of app security best practices, not scrambling after a breach.

Who Needs a CASA Assessment?

• Any app using sensitive Google APIs:
  • The short answer, if your app wants to access restricted scopes of Google user data, think Gmail read/write, full Drive file access, or other broad permissions then a CASA assessment is required.
  • This includes server to server services, SaaS products, and workspace add ons that pull data from Google accounts. Google’s identity guidelines explicitly tie CASA to OAuth scope verification.

• Google Workspace Marketplace apps:
  • Even if you only build Google Workspace add ons or Marketplace apps, CASA can come into play.
  • To earn the Marketplace security badge which greatly boosts visibility, your app must pass a Tier 3 CASA audit.
  • In practical terms, UK developers targeting enterprise customers via Google Workspace should budget for CASA.

• When else:
  • The CASA framework also appears in Google’s Data Portability and Workspace API policies.
  • For example, the Data Portability API policy Nov 2024 explicitly says, Required security measures for Restricted Scopes include following the Cloud Application Security Assessment CASA.
• Likewise, the Google Workspace API policy mandates CASA for any app with restricted scopes.
  • If your app falls under those policies, CASA is not optional, it's part of being in Google’s ecosystem.

Key point: Don’t confuse CASA with generic pen testing. It’s specifically for Google bound applications. If you only use non Google cloud services AWS, Azure or have no restricted scopes, CASA doesn’t apply. But if Google APIs are involved, CASA is the official requirement.

CASA Tiers and Requirements

CASA uses a three tier system to scale the assessment effort to the app’s risk.

Important update: the Tier 1 to 3 naming is the legacy model. The App Defense Alliance now describes apps in terms of Assurance Levels, and for CASA, Google assigns your app to AL1 or AL2. The requirements themselves are identical at every level; the only thing that changes is the rigor of verification. If you read older guidance that talks about Tiers, this is the mapping:

Two things matter here. First, you do not choose your level, Google does, based on the sensitivity of the data you touch, how many users you have, and its own risk signals. Second, the assignment tends to be sticky: once an app is validated at the lab-tested level it generally stays there in future years, which is the same behaviour the old Tier 3 had.

The pass criteria are also worth knowing before you start. CASA requirements are mapped to MITRE CWEs (Common Weakness Enumerations), each tagged with a high, medium, or low likelihood of exploit. To pass, your results must show no findings tied to CWEs with a high likelihood of exploit, and on recertification, no medium-likelihood ones either. That is the bar that decides whether a submission is accepted, so it is the list to work through first.

• Tier 1 Self Assessment:
  • This is the lowest level. It may involve the developers running automated scans DAST/SAST against OWASP ASVS controls, but no formal third party audit.
  • Tier 1 covers apps with limited risk, few users, no sensitive scopes. It’s often just a checklist with internal testing.
• Tier 2:
  • Mid level. A Tier 2 app typically uses some sensitive scopes or has moderate user count. Here, you use authorized labs or certified scanners to review your app. Labs perform vulnerability scans and report issues.
  • Tier 2 still does not require full lab testing of all OWASP categories, but covers many critical checks.
• Tier 3 Full Lab Audit:
  • The highest level. Required for apps handling highly sensitive data or aiming for Marketplace trust badges.
  • A Tier 3 audit is a full third party security test: labs manually test all relevant OWASP ASVS categories authentication, access control, cryptography, etc. and produce a Letter of Validation LOV. It’s the most thorough and time consuming and expensive tier.

Figure: The CASA framework uses three risk based tiers for cloud apps. Each level has defined ASVS based requirements and testing scope.

All tiers share some common rules: the assessment focuses on the app itself not the cloud infra, and results must be updated annually.

Google requires each approved app to revalidate every 12 months. That means even after you pass, plan for a yearly retest. Also, any time you add new restricted scopes, you might need an updated CASA review.

CASA vs Regular Pen Testing

It’s worth noting how CASA differs from broader penetration testing for compliance. CASA is narrower in scope: it tests the application layer according to OWASP ASVS controls. It doesn’t include, for example, attacking the cloud network or physical data centers.

For most Tier 3 audits, labs focus on web/API endpoints, mobile backends, and data storage as used by the app. Some OWASP categories like error handling or threat modeling are emphasized, whereas things like network sniffing are out of scope. In that sense, CASA is like a specialized web/mobile app pentest tailored for Google’s data integration scenario.

For cloud apps, you should still use professional penetration testing services to assess infrastructure, networks, and other attack paths separately. CASA complements those efforts by covering key application controls. If you already have regular pentesting, you’ll find many overlaps. But don’t assume a generic pentest alone will satisfy Google: only a CASA report from an authorized lab gets you the official LOV.

How the CASA Assessment Works

Achieving CASA compliance is a multi step process. Here’s a high level how to for Google integrated apps:

1. Determine your tier and requirements. Check the App Defense Alliance or Google documentation to see which CASA tier applies. Factors include the number of users, user data sensitivity, and scopes. Use the CASA Accelerator if available: this tool lets you enter your existing certifications ISO 27001, PCI, etc. or test results to minimize duplicate checks. The goal is to map your app to the required OWASP ASVS controls for that tier.
2. Prepare internally. Before involving a lab, run your own vulnerability scans and code reviews. Ensure you’ve implemented the core ASVS Level 1 controls secure authentication, input validation, encryption at rest, etc.. Fix obvious issues and have evidence ready. This step often involves working with developers to address findings from SAST/DAST and threat models.
3. Engage an authorized CASA lab. Only Google approved labs can issue CASA Letters of Validation. Examples include TAC Security, Leviathan, DEKRA, Bishop Fox, etc.. Contact the lab with your app details. They will guide you through submitting your app URLs, credentials for testing.
4. Undergo the assessment. The lab will perform the tests corresponding to your tier. For Tier 3, expect manual tests on all 14 OWASP ASVS categories for ASVS 4.0, per CASA requirements. The lab will document vulnerabilities and advise on fixes some lab packages include remediation support. They then compile a report.
5. Receive and submit the Letter of Validation LOV. If you pass, the lab issues a signed LOV certifying CASA compliance. For Marketplace apps, this is your security verification badge pass. You submit the LOV and any other required docs to Google via the Cloud Console’s OAuth App Verification process.
6. Annual revalidation. After approval, plan to repeat the security assessment yearly. Google typically notifies you when it’s time. Keep your contact info updated so the right devs get the re certification reminder. Make necessary fixes during the year to stay in compliance.

Quick tip: Turnaround can be relatively fast. For example, one provider TAC Security advertises Tier 2 reassessment in 1- 3 weeks and Tier 3 in 2- 4 weeks once the lab has everything. However, delays in finding issues can add time. Budget a couple of months to be safe.

How to Pass CASA the First Time

The teams that sail through CASA do a few things deliberately, and each one removes a common reason submissions get rejected.

• Use the CASA Accelerator early. This ADA tool maps your existing certifications, ISO 27001, SOC 2, PCI DSS and others, to CASA requirements, so anything already covered does not need retesting. It then hands you the exact list of CWEs you still have to scan for. Claiming credit for compliance certifications you already hold can remove whole blocks of requirements.
• Use ADA's pre-built scan configs and Docker images. Functional requirements are verified with an application security testing scan, and ADA publishes configuration files and Docker images for approved scanners. Custom tooling is allowed, as long as it is CWE-compatible, meets the OWASP Benchmark, and outputs machine-readable pass/fail results, but it is a frequent source of submissions rejected for nonconformance. The provided configs are tuned to the required CWEs.
• Fix high-likelihood CWEs first. Those are the ones that block a pass. The OWASP ASVS cheat sheets are the reference for remediating each one.
• Harden the OAuth implementation specifically. Use the Authorization Code flow with PKCE, validate redirect_uri and state, and avoid deprecated flows. Because restricted scopes are what trigger CASA in the first place, OAuth security is where assessors look hardest.
• Treat it as real hardening, not paperwork. Because CASA is pure ASVS, an ASVS-aligned API penetration test or application assessment beforehand surfaces the failures on your terms, not in a rejected submission. The same goes for the tooling side, covered in our guide to API security testing tools.

CASA Compliance Checklist

• Pre assessment: Internal scans DAST/SAST, threat model documentation, privacy policy, and least privilege scopes in place.
• Assessment: Official lab testing Tier 1/2/3 per your app. DAST, targeted SAST, config review, manual verification of controls.
• LOV Submission: Letter of Validation to Google, plus any scope justification especially if using highly restricted Gmail/Drive scopes.
• Post assessment: Remediate any findings labs often provide remediation guidance, then get reverified.

See our web application penetration testing services for deeper pentesting methodology insights on the application layer CASA covers.

CASA Tier 2 vs Tier 3: A Quick Comparison

• Scope: Tier 2 covers many but not all ASVS controls often excludes very sensitive checks; Tier 3 covers all CASA controls and is required for highly sensitive data flows.
• Auditor Role: Tier 2 can use a combination of automated tools and lab verification; Tier 3 is always a hands-on lab audit.
• Cost: Tier 2 is cheaper, labs may offer one off tests or small retainer plans. For example, TAC Security lists Tier 2 plans from $540 to $1,800. Tier 3 is pricier; TAC’s Tier 3 plan is $4,500.
• Outcome: Both yield a letter of validation, but only Tier 3 grants the full Google Marketplace security badge and covers the strictest Google requirements.
• Update Frequency: Both need annual revalidation, but Tier 3 apps are locked in at that level each year.

Real World Example: Qlik’s Google Integration

Major data platforms have already gone through CASA.

For instance, Qlik Cloud achieved CASA Tier 3 certification for its integration with Google. Qlik’s trust page confirms

CASA Tier 3 is a security assessment framework based on OWASP ASVS that is mandated by Google Marketplace when cloud applications access sensitive scope data in Google Cloud.

In other words, Qlik proved its app security to Google’s standards and earned the independent security badge. This shows CASA is not just theory, it's a real requirement for enterprise cloud apps in production.

Common Myths and FAQs

• Myth: I already did a penetration test last year. While great, a generic pentest is not the same as CASA. Only a CASA specific audit by an approved lab satisfies Google’s rules.
• Myth: I’m a small app, I can skip it. There’s no revenue based waiver. Even small developers requesting restricted scopes are expected to comply. Tier 2 or even Tier 1 might suffice, but ignoring CASA risks your app being blocked.
• Myth: Once I have CASA, I’m done. No CASA is a continuous process. Google requires yearly revalidation, and you must stay compliant if you add new scopes or features.
• Tip: Leverage the CASA Accelerator. If you have existing certifications e.g. ISO 27001, PCI, etc., the accelerator can reduce overlap in testing. Ask your lab about it.

CASA compliance isn't optional, it's essential for Google integrated apps. By adopting the CASA framework as used by leaders like Qlik and mandated by Google, developers ensure their cloud applications are hardened against common threats and meet Google's strict OAuth requirements.

The tiered approach means you can start small Tier 1 scans and work up as your app grows, but ultimately Tier 3 is the gold standard for maximum trust.

We hope this guide has clarified what CASA is, why it matters, and how to navigate its requirements. Remember: the goal is not just getting a badge, but truly securing your users’ data.

Ready to Strengthen Your Defenses? Today's security threats demand readiness. If you're integrating with Google APIs and need to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike can help.

Our team of experienced practitioners provides clear, actionable guidance on penetration testing and security assessments.

Explore our penetration testing services to see how we uncover vulnerabilities before attackers do. Drop us a line we’re always ready to dive in.

About the AuthorMohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Frequently Asked Questions

What triggers the need for a CASA assessment?

• Requesting any Google API restricted scope like full Gmail or Drive access triggers CASA.
• Also, Google may require it during OAuth app verification if your app handles sensitive data.

Can I do CASA myself?

• You can do much of the preparatory work scans, code review, but Google requires an authorized third party lab to perform the official CASA audit and issue the Letter of Validation.

How much does a CASA audit cost?

• Costs vary by lab and tier. Industry figures suggest Tier 2 audits start around $500- $1,000 one time or yearly, while Tier 3 audits are typically several thousand dollars TAC lists $4,500.
• Budget for annual repeat assessments, as Google requires yearly renewal.

What's the CASA assessment turnaround time?

• According to providers, Tier 2 audits can wrap up in about 1- 3 weeks and Tier 3 in 2- 4 weeks once testing begins.
• Your overall timeline also depends on how quickly you fix issues and coordinate with the lab.

How is CASA related to OWASP ASVS?

• CASA is based on OWASP AS vs It essentially picks a subset of ASVS controls relevant to Google cloud apps.
• In fact, CASA is based 100% on the OWASP ASVS; no proprietary requirements or confusing jargon.
• Think of ASVS as the foundation and CASA as Google’s implementation roadmap.

Do I need CASA if I only use OAuth sensitive, not restricted scopes?

• Sensitive scopes like basic Gmail read typically require a simpler verification.
• CASA specifically targets the restricted scopes those with very broad access.
• However, it’s wise to follow CASA like controls for any app handling user data.

What happens if I fail a CASA audit?

• If critical issues are found, the lab will not sign off. You must remediate all showstoppers before getting the LOV.
• Failing an audit means Google will not approve your app’s restricted scope or listing.
• It’s not a pass/fail by law, but effectively your app won’t move forward without it.

What are the CASA assurance levels, and what happened to Tiers 1 to 3?

CASA historically used Tiers 1 to 3. The App Defense Alliance now uses Assurance Levels: AL0 is a developer self-assessment that does not produce formal certification, AL1 is developer-tested and lab-reviewed (the developer submits evidence and an approved lab checks it), and AL2 is a direct lab test of the running application. For CASA, Google assigns AL1 or AL2 based on your data sensitivity and user count. The requirements are the same at every level; only the rigor of verification changes.

How often do I need to renew CASA?

Every 12 months, measured from the effective date of your previous Letter of Validation. Google's team emails you when it is time. The reassessment is a comprehensive test of the whole app regardless of whether you changed anything, and the required level can rise if your user base or data handling grew. Start before your current LOV expires so your Google API access never lapses.

What is the CASA Accelerator?

It is an App Defense Alliance tool that maps your existing security certifications, such as ISO 27001, SOC 2, or PCI DSS, to CASA requirements so anything already covered does not need retesting. It then produces the exact list of CWEs you still have to scan for. Running it early is the single biggest time-saver for teams that already hold certifications.