Google CASA 2026: Cloud Application Security Assessment

• CASA is the App Defense Alliance's security assessment framework that Google uses for cloud apps handling restricted Google user data. It is built on the OWASP ASVS and is risk based: Google assigns each app to Assurance Level 1 or 2 (the successors of the old Tiers 2 and 3).
• Apps that access restricted-scope data (e.g. Gmail or Drive APIs) from or through a server must pass a CASA assessment by an ADA-authorized lab, then revalidate yearly. AL2, the lab-tested level and successor of Tier 3, is required for the Google Workspace Marketplace security verification badge.
• Typical assessment costs are an indicative market range of a few hundred to a few thousand dollars per year, depending on level and lab (TAC Security's published list prices ran from $675 to $5,400 in November 2026). Authorized labs such as TAC Security, Bishop Fox, DEKRA and NetSentries handle the testing and issue a Letter of Validation (LOV).
• Why it matters in 2026: With rising privacy regulations and Google's strict OAuth policies, CASA compliance is now mandatory for apps that need wide Google data access. Failing to pass CASA can block your app's approval or Google integration.

Updated: November 2026. Reflects the CASA v2 specification (version 2.1.1, June 2026), Assurance Levels AL1 and AL2 in place of Tiers, the current ADA authorized lab list, and current published lab pricing.

Google CASA at a Glance

The one line to remember: CASA is not optional for restricted-scope apps, it is the price of continued access to Google user data, and it comes due every year.

What Is Google CASA?

Google's Cloud Application Security Assessment (CASA) is a standardized security review for cloud apps, created by the App Defense Alliance (ADA), an industry group founded by Google. In November 2023 the ADA moved under the Linux Foundation's Joint Development Foundation, with Google, Meta and Microsoft on its steering committee, making it a neutral, community-run standard rather than a single vendor's checklist. The requirements are now maintained as CASA v2 by ADA's Application Security Assessment Working Group (version 2.1.1 dated June 2026). In practice, CASA is a security audit framework that uses the OWASP ASVS (Application Security Verification Standard) as its foundation and turns it into testable requirements with clear acceptance criteria.

It defines a consistent set of baseline controls in six areas, authentication, session management, access control, communications (cryptography), data validation and sanitization, and configuration, that any Google integrated app must meet. CASA uses a risk based approach: apps are classified by user count, OAuth scopes, data sensitivity and other signals, and then verified accordingly.

Practically, CASA serves as a high assurance pentest for cloud apps. At AL2, an ADA-authorized lab performs a time limited, functional audit of your app's web application and web-accessible APIs. This means the lab will run DAST (dynamic analysis), review evidence or code snippets, and other checks, focused on the application layer and, where applicable, its deployment and user data storage rather than a full infrastructure test. At AL1, you run the tests and the lab reviews your evidence.

The goal is to show that your app handles Google data securely and can promptly delete it on request.

Figure: Google Workspace Marketplace shows an independent security verification badge on apps that passed CASA at Assurance Level 2 (the old Tier 3).

Why CASA Matters in 2026

User trust and compliance Google requires CASA for apps that request restricted OAuth scopes, those that provide broad access to Gmail, Drive and other sensitive Google user data, and that access that data from or through a server.

In Google's words, apps "accessing restricted data from or through a third-party server must undergo an annual security assessment by a Google-approved third party" (restricted scope verification). For U.S. SaaS vendors handling Google user data at scale, CASA is mandatory.

The stakes are high. Apps validated at AL2 (formerly Tier 3) earn a coveted security verification badge in the Google Workspace Marketplace. This badge signals to customers that the app has been rigorously audited.

In contrast, apps failing CASA may be denied API access or removed from listings. With the ongoing tightening of data privacy rules and Google's OAuth policies, CASA compliance is now a go/no go for Google integrations. It's especially critical for enterprise or SaaS vendors who live and die by API trustworthiness.

Standardization and industry alignment CASA fills a big gap. Over the past decade, cloud infrastructure security has improved dramatically but application layer security still lags.

By aligning with OWASP ASVS and sponsoring a tiered framework, Google and the ADA are pushing the industry toward a common standard for app security.

Knowing CASA means you're on the forefront of app security best practices, not scrambling after a breach.

Who Needs a CASA Assessment?

• Any app using sensitive Google APIs:
  • The short answer, if your app wants to access restricted scopes of Google user data, think Gmail read/write, full Drive file access, or other broad permissions, and your servers can access that data, then a CASA assessment is required.
  • This includes server to server services, SaaS products, and workspace add ons that pull data from Google accounts. Google’s identity guidelines explicitly tie CASA to OAuth scope verification.

• Google Workspace Marketplace apps:
  • Even if you only build Google Workspace add ons or Marketplace apps, CASA can come into play.
  • To earn the Marketplace security badge, which greatly boosts visibility, your app must be validated at CASA Assurance Level 2 (AL2), the successor of Tier 3 (Google Workspace Marketplace guidance).
  • In practical terms, UK developers targeting enterprise customers via Google Workspace should budget for CASA.

• When else:
  • The CASA framework also appears in Google’s Data Portability and Workspace API policies.
  • For example, Google's Data Portability API documentation says apps requesting restricted scopes must complete a security assessment as part of verification, and re-verify annually.
• Likewise, the Google Workspace API policy mandates CASA for apps with restricted scopes that access that data from or through a server.
  • If your app falls under those policies, CASA is not optional, it's part of being in Google’s ecosystem.

Key point: Don’t confuse CASA with generic pen testing. It’s specifically for Google bound applications. If you only use non Google cloud services AWS, Azure or have no restricted scopes, CASA doesn’t apply. But if Google APIs are involved, CASA is the official requirement.

CASA Tiers and Requirements

CASA originally used a three tier system to scale the assessment effort to the app's risk.

Important update: the Tier 1 to 3 naming is the legacy model. The App Defense Alliance now describes apps in terms of Assurance Levels, and for CASA, Google assigns your app to AL1 or AL2. The requirements themselves are identical at every level; the only thing that changes is the rigor of verification. If you read older guidance that talks about Tiers, this is the mapping:

Two things matter here. First, you do not choose your level, Google does, based on the sensitivity of the data you touch, how many users you have, and its own risk signals. Second, the assignment tends to be sticky: once an app is validated at the lab-tested level it generally stays there in future years, which is the same behaviour the old Tier 3 had.

The pass criteria are also worth knowing before you start. In CASA v2, each requirement comes with specific audit test cases and acceptance criteria, listed in the CASA Test Guide. Several are verified with an authenticated DAST scan using the ADA's published Burp Suite audit scan configuration. The lab validates every applicable requirement before it issues an LOV, so the Test Guide is the list to work through first.

• Tier 1 Self Assessment (now AL0):
  • This is the lowest level. It may involve the developers running automated scans DAST/SAST against OWASP ASVS controls, but no formal third party audit.
  • Tier 1 covers apps with limited risk, few users, no sensitive scopes. It’s often just a checklist with internal testing.
• Tier 2 (now AL1):
  • Mid level. A Tier 2 app typically used some restricted scopes with a moderate user count. You ran the required tests yourself and an authorized lab reviewed the results, which is how AL1 works today.
  • Tier 2 did not involve the lab retesting the app directly, but the same requirements still had to be met.
• Tier 3 Full Lab Audit (now AL2):
  • The highest level. Required for apps handling highly sensitive data or aiming for Marketplace trust badges.
  • A Tier 3 audit is a full third party security test: labs manually test all relevant OWASP ASVS categories authentication, access control, cryptography, etc. and produce a Letter of Validation LOV. It’s the most thorough and time consuming and expensive tier.

Figure: CASA originally used three risk based tiers for cloud apps; Google now assigns AL1 or AL2. Each level has defined ASVS based requirements and testing scope.

All tiers share some common rules: the assessment focuses on the app itself not the cloud infra, and results must be updated annually.

Google requires each approved app to revalidate every 12 months. That means even after you pass, plan for a yearly retest. Also, any time you add new restricted scopes, you might need an updated CASA review.

CASA vs Regular Pen Testing

It’s worth noting how CASA differs from broader penetration testing for compliance. CASA is narrower in scope: it tests the application layer according to OWASP ASVS controls. It doesn’t include, for example, attacking the cloud network or physical data centers.

For AL2 (formerly Tier 3) assessments, labs focus on web and API endpoints and the data storage used by the app: authentication and OAuth integration, session handling, access control, cryptography in transit, input handling and configuration. Things like network sniffing or physical security are out of scope. In that sense, CASA is like a specialized web/API app pentest tailored for Google's data integration scenario.

For cloud apps, you should still use professional penetration testing services to assess infrastructure, networks, and other attack paths separately. CASA complements those efforts by covering key application controls. If you already have regular pentesting, you’ll find many overlaps. But don’t assume a generic pentest alone will satisfy Google: only a CASA report from an authorized lab gets you the official LOV.

How the CASA Assessment Works

Achieving CASA compliance is a multi step process. Here’s a high level how to for Google integrated apps:

1. Understand your assurance level. Google, not you, assigns AL1 or AL2 based on user count, data sensitivity and scopes; the Google Trust and Safety team contacts you when the assessment is due (Google's security assessment page). Use the CASA Accelerator: it maps existing certifications such as ISO 27001 or PCI DSS to CASA requirements to minimize duplicate checks. The goal is to map your app to the CASA requirements that still need verification.
2. Prepare internally. Before involving a lab, run your own vulnerability scans and code reviews. Ensure you've implemented the core CASA requirements (secure authentication, session management, access control, TLS, input validation, secure configuration). Fix obvious issues and have evidence ready. This step often involves working with developers to address findings from SAST/DAST and threat models.
3. Engage an authorized CASA lab. Only ADA-authorized labs can issue CASA Letters of Validation. As of November 2026, labs listed by the ADA with CASA services include TAC Security, Bishop Fox, DEKRA and NetSentries; check the live list before you choose. Contact the lab with your app details. They will guide you through submitting your app URLs and test credentials.
4. Undergo the assessment. The lab will verify the CASA test cases for your level. At AL2 it tests each test case directly against your running app across all six requirement areas; at AL1 it reviews the evidence you submit. The lab will document failures and advise on fixes; some lab packages include remediation support. They then compile a report.
5. Receive and submit the Letter of Validation LOV. If you pass, the lab issues a signed LOV certifying CASA compliance. For Marketplace apps validated at AL2, this LOV also qualifies the app for the security verification badge. You submit the LOV and any other required docs to Google via the Cloud Console’s OAuth App Verification process.
6. Annual revalidation. After approval, plan to repeat the security assessment yearly. Google typically notifies you when it’s time. Keep your contact info updated so the right devs get the re certification reminder. Make necessary fixes during the year to stay in compliance.

Quick tip: Turnaround can be relatively fast. For example, TAC Security advertises assessment to LoV in about 1 to 3 weeks for AL1 packages and 2 to 4 weeks for AL2 (November 2026) once the lab has everything. However, delays in fixing issues can add time. Budget a couple of months to be safe.

How to Pass CASA the First Time

The teams that sail through CASA do a few things deliberately, and each one removes a common reason submissions get rejected.

• Use the CASA Accelerator early. This tool maps your existing certifications, ISO 27001, SOC 2, PCI DSS and others, to CASA requirements, so anything already covered needs fewer checks. Claiming credit for compliance certifications you already hold can remove whole blocks of requirements.
• Use ADA's published scan configuration. CASA v2 verifies several requirements with an authenticated DAST scan, and ADA publishes a Burp Suite audit scan configuration for it. Running the same configuration yourself before the lab does is the quickest way to see what will fail.
• Fix failing test cases first. Work through the CASA Test Guide requirement by requirement; the OWASP ASVS and its cheat sheets remain the reference for remediating each one.
• Harden the OAuth implementation specifically. Use the Authorization Code flow with PKCE, validate redirect_uri and state, and avoid deprecated flows. Because restricted scopes are what trigger CASA in the first place, OAuth security is where assessors look hardest.
• Treat it as real hardening, not paperwork. Because CASA is built on ASVS, an ASVS-aligned API penetration test or application assessment beforehand surfaces the failures on your terms, not in a rejected submission. The same goes for the tooling side, covered in our guide to API security testing tools.

CASA Compliance Checklist

• Pre assessment: Internal scans DAST/SAST, threat model documentation, privacy policy, and least privilege scopes in place.
• Assessment: Lab review of your evidence (AL1) or direct lab testing (AL2), as assigned by Google. DAST, targeted code snippet review, config review, manual verification of controls.
• LOV Submission: Letter of Validation to Google, plus any scope justification especially if using highly restricted Gmail/Drive scopes.
• Post assessment: Remediate any findings labs often provide remediation guidance, then get reverified.

See our web application penetration testing services for deeper pentesting methodology insights on the application layer CASA covers.

CASA Tier 2 vs Tier 3: A Quick Comparison

• Scope: The requirements are the same at both levels. Tier 2 (now AL1) verifies them through developer-supplied evidence that a lab reviews; Tier 3 (now AL2) has the lab test each one directly, and is what Google assigns for the most sensitive data flows.
• Auditor Role: Tier 2 can use a combination of automated tools and lab verification; Tier 3 is always a hands-on lab audit.
• Cost (indicative market prices, not Google fees): TAC Security's published list prices in November 2026 were $675 to $855 for a one-time AL1 assessment, $4,500 for an Enterprise AL1 plan, and $5,400 for an AL2 assessment. Other labs such as Bishop Fox and DEKRA quote per engagement, so get several quotes.
• Outcome: Both yield a Letter of Validation, but only AL2 (Tier 3) qualifies for the Google Workspace Marketplace security verification badge.
• Update Frequency: Both need annual revalidation, but Tier 3 apps are locked in at that level each year.

Real World Example: Qlik’s Google Integration

Major data platforms have already gone through CASA.

For instance, Qlik Cloud achieved CASA Tier 3 certification for its integration with Google. Qlik's trust page confirms:

CASA Tier 3 is a security assessment framework based on OWASP ASVS that is mandated by Google Marketplace when cloud applications access sensitive scope data in Google Cloud.

In other words, Qlik proved its app security to Google’s standards and earned the independent security badge. This shows CASA is not just theory, it's a real requirement for enterprise cloud apps in production.

Common Myths and FAQs

• Myth: I already did a penetration test last year. While great, a generic pentest is not the same as CASA. Only a CASA specific audit by an approved lab satisfies Google’s rules.
• Myth: I'm a small app, I can skip it. There's no revenue based waiver. Even small developers requesting restricted scopes are expected to comply. Google may assign AL1 rather than AL2, and narrow exceptions exist (for example personal-use apps or apps used only inside your own Workspace organization), but ignoring CASA risks your app being blocked.
• Myth: Once I have CASA, I’m done. No CASA is a continuous process. Google requires yearly revalidation, and you must stay compliant if you add new scopes or features.
• Tip: Leverage the CASA Accelerator. If you have existing certifications e.g. ISO 27001, PCI, etc., the accelerator can reduce overlap in testing. Ask your lab about it.

CASA compliance isn't optional, it's essential for Google integrated apps. By adopting the CASA framework as used by leaders like Qlik and mandated by Google, developers ensure their cloud applications are hardened against common threats and meet Google's strict OAuth requirements.

Google assigns the level, so you cannot simply start at a lower tier, but preparing against the full requirement set early means a move from AL1 to AL2 as your app grows is no surprise. AL2 remains the gold standard for maximum trust.

We hope this guide has clarified what CASA is, why it matters, and how to navigate its requirements. Remember: the goal is not just getting a badge, but truly securing your users’ data.

Ready to Strengthen Your Defenses? Today's security threats demand readiness. If you're integrating with Google APIs and need to validate your security posture, identify hidden risks, or build a resilient defense strategy, DeepStrike can help.

Our team of experienced practitioners provides clear, actionable guidance on penetration testing and security assessments.

Explore our penetration testing services to see how we uncover vulnerabilities before attackers do. Drop us a line we’re always ready to dive in.

About the AuthorMohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Frequently Asked Questions

What triggers the need for a CASA assessment?

• Requesting a Google API restricted scope (like full Gmail or Drive access) when your app can access that data from or through a server triggers CASA.
• Also, Google may require it during OAuth app verification if your app handles sensitive data.

Can I do CASA myself?

• You can do much of the preparatory work scans, code review, but Google requires an authorized third party lab to perform the official CASA audit and issue the Letter of Validation.

How much does a CASA audit cost?

• Costs vary by lab and level; these are indicative market ranges, not Google fees. TAC Security's published prices in November 2026 ran from $675 to $855 for a one-time AL1 assessment to $5,400 for AL2; other labs quote per engagement.
• Budget for annual repeat assessments, as Google requires yearly renewal.

What's the CASA assessment turnaround time?

• According to providers, AL1 assessments can reach a Letter of Validation in about 1 to 3 weeks and AL2 in 2 to 4 weeks once testing begins (TAC Security, November 2026).
• Your overall timeline also depends on how quickly you fix issues and coordinate with the lab.

How is CASA related to OWASP ASVS?

• CASA is built on the OWASP ASVS: ADA took ASVS as its foundation and turned the controls relevant to web apps and APIs into testable CASA requirements.
• The current CASA v2 specification groups them into six areas: authentication, session management, access control, communications, data validation and sanitization, and configuration.
• Think of ASVS as the foundation and CASA as the testable roadmap Google relies on.

Do I need CASA if I only use OAuth sensitive, not restricted scopes?

• Sensitive scopes (for example most Calendar or Contacts scopes) require OAuth app verification but not a security assessment. Note that most Gmail read scopes, including read-only Gmail access, are classed as restricted.
• CASA specifically targets the restricted scopes those with very broad access.
• However, it’s wise to follow CASA like controls for any app handling user data.

What happens if I fail a CASA audit?

• If critical issues are found, the lab will not sign off. You must remediate all showstoppers before getting the LOV.
• Failing an audit means Google will not approve your app’s restricted scope or listing.
• It’s not a pass/fail by law, but effectively your app won’t move forward without it.

What are the CASA assurance levels, and what happened to Tiers 1 to 3?

CASA historically used Tiers 1 to 3. The App Defense Alliance now uses Assurance Levels: AL0 is a developer self-assessment that does not produce formal certification, AL1 is developer-tested and lab-reviewed (the developer submits evidence and an approved lab checks it), and AL2 is a direct lab test of the running application. For CASA, Google assigns AL1 or AL2 based on your data sensitivity and user count. The requirements are the same at every level; only the rigor of verification changes.

How often do I need to renew CASA?

At least every 12 months after your assessor's approval date. Google's Trust and Safety team contacts you when it is time. The required level can rise if your user base or data handling grew. Start before your current validation expires so your Google API access never lapses.

What is the CASA Accelerator?

It is a CASA tool that maps your existing security certifications, such as ISO 27001, SOC 2, or PCI DSS, to CASA requirements so anything already covered needs fewer checks. Running it early is the single biggest time-saver for teams that already hold certifications.