Google CASA AL1 Security Assessment: Requirements, Costs & How to Get Your LoV
What is a Google CASA AL1 security assessment?
A Google CASA AL1 security assessment is a verified self-assessment under the App Defense Alliance Cloud Application Security Assessment framework. Developers prepare application security evidence, and an authorized testing laboratory reviews it. Applications assigned AL1 by Google must successfully complete the applicable assessment process to obtain a Letter of Validation (LoV). CASA AL1 assessments through Secusy start at $499.
Already received your CASA AL1 notification from Google? Get your instant CASA AL1 quote. Compare assessment packages, see pricing and begin online without scheduling a sales call.
What is a CASA security assessment?
CASA stands for Cloud Application Security Assessment. It is the App Defense Alliance's security assessment framework for web applications and web-accessible APIs. Google uses CASA as part of its security verification process for applications requesting access to restricted Google user data.
CASA sets a consistent baseline of application security requirements covering areas such as authentication, session management, access control, communications, input validation and secure configuration. The requirements are informed by the OWASP Application Security Verification Standard (ASVS). Rather than treating every application identically, CASA uses assurance levels based on the risk associated with the application and its data handling.
| Term | Meaning |
|---|---|
| CASA | Cloud Application Security Assessment |
| ADA | App Defense Alliance |
| AL1 | Assurance Level 1 — Verified Self Assessment |
| AL2 | Assurance Level 2 — Lab Assessment |
| SAQ | Self-Assessment Questionnaire |
| LoV | Letter of Validation |
| ASVS | OWASP Application Security Verification Standard |
The framework is maintained by the App Defense Alliance, while Google's OAuth verification process determines when an application must complete a security assessment. Official references: App Defense Alliance CASA and Google Security Assessment.
Do I need Google CASA AL1?
You may need CASA if your application requests access to restricted Google OAuth scopes and Google requires you to complete a security assessment. Examples of products that may fall within this process include SaaS applications integrating Google Workspace, email management products, document-processing applications and AI applications that access Google user data.
Requesting a particular scope does not automatically establish your assurance level. Google evaluates the application and communicates the level it requires. To find out whether you were assigned AL1 or AL2, review the assessment notification from Google's Trust and Safety team; it should identify the required process or give instructions for proceeding.
If your assigned level is unclear, get clarification before purchasing. Do not buy AL1 simply because it is cheaper than AL2. Your assessment must satisfy the level Google assigned.
CASA AL1 vs AL2: what is the difference?
AL1 is a verified self-assessment: developer-prepared testing with authorized laboratory review of the evidence. AL2 is a lab assessment: a full application assessment performed by an authorized testing laboratory.
| Assessment component | CASA AL1 | CASA AL2 |
|---|---|---|
| Assurance model | Verified Self Assessment | Lab Assessment |
| Testing responsibility | Typically developer-led | Authorized laboratory |
| Evidence evaluation | Authorized lab | Authorized lab |
| Assurance level selection | Assigned by Google or applicable program | Assigned by Google or applicable program |
| Secusy starting price | $499 | See the AL2 service |
The App Defense Alliance defines the distinction by assessment responsibility and assurance depth. Platform-specific program requirements may add conditions. If Google has assigned AL2, see the Secusy CASA AL2 assessment.
What are the requirements for CASA AL1?
CASA assesses the security of your application and its handling of relevant user data. The applicable testing guide defines the actual criteria. The categories below are practical preparation areas, not a substitute for the complete official CASA testing guide.
| Security area | What developers should prepare to demonstrate |
|---|---|
| Authentication | Secure login and authentication controls |
| Session management | Secure session handling and invalidation |
| Access control | Appropriate restrictions on access to application data and APIs |
| Communications | Secure transmission of information |
| Input validation | Controls for malicious or unexpected input |
| Configuration | Secure application and component configuration |
To begin its CASA AL1 engagement, Secusy requests:
- Google's assessment notification.
- Google Cloud project number and relevant OAuth Client IDs.
- Application and API URLs.
- Application architecture and relevant data-flow information.
- Details of third-party processors handling Google-sourced data.
- Completed SAQ information.
- Relevant authenticated scan evidence.
- Appropriate test-account access through the customer portal.
You can prepare the questionnaire and scan evidence in parallel rather than waiting for one to finish before starting the other.
How do I prepare my application for CASA AL1 testing?
Preparation is easier when the development team separates its work into application identification, security testing and questionnaire completion.
- Confirm the assessment scope. Identify the application, OAuth integrations, relevant APIs and environments involved in processing the Google user data covered by the assessment. Keep Google's notification handy so scope can be checked against its instructions.
- Prepare authenticated application access. Create the test accounts needed to reach in-scope functionality. An unauthenticated scan may not exercise the functions and endpoints that require user sessions. For Secusy's AL1 offering, authenticated OWASP ZAP and Burp Suite evidence can be used, subject to the applicable acceptance criteria.
- Run the security scan. Use Secusy's integrated scanner or prepare acceptable evidence with your own tools. Make sure the scan covers the relevant application functionality, not just the public landing page.
- Complete the Self-Assessment Questionnaire. Answer based on controls your organization actually operates, and provide supporting evidence where requested. See our step-by-step SAQ guide.
- Address security findings. Investigate identified vulnerabilities and resolve the ones that prevent validation. Where findings are false positives, prepare the technical justification the assessor needs to verify them.
- Submit evidence for independent review. The authorized laboratory evaluates your evidence against the applicable criteria. If information is missing or further remediation is needed, the evidence may need to be updated and reviewed again.
How much does a Google CASA AL1 assessment cost?
Secusy offers three CASA AL1 packages, delivered through its digital service platform and powered by ValueMentor.
| Plan | Price | Best for |
|---|---|---|
| Basic | $499 starting price, one-time | Customer-led preparation |
| Advanced | $599, one-time | Expanded verification support |
| Fully Managed | $3,000, one-time | Analyst-led assessment support |
Prices exclude applicable taxes. Confirm the scope and current price at checkout.
| Your situation | Suggested plan |
|---|---|
| Your developers can complete the SAQ and prepare scanning evidence | Basic |
| Your team wants expanded verification support and more flexibility for rescanning | Advanced |
| Your organization wants analysts to manage the assessment work | Fully Managed |
The published package structure includes two retests on Basic, with additional retests at $75 each. Advanced and Fully Managed include unlimited rescans until a clean validation result is achieved within the engagement terms. The plan you select does not change Google's underlying security requirements; it changes the level of delivery assistance and included support.
Compare CASA AL1 plans and get instant pricing
How long does CASA AL1 take?
Secusy's published processing timeframe is 2–5 business days after the SAQ and scan evidence are complete and clean. That is different from the total time a first-time applicant needs to prepare evidence, remediate vulnerabilities and complete validation. For planning, Secusy currently advises allowing approximately 1–5 weeks end to end for a first-time assessment, depending on preparation and remediation.
Common causes of delay include incomplete questionnaire answers, invalid test credentials, insufficient scan coverage, unresolved security findings and unclear application scope. Preparing the questionnaire, test environment and application details before you submit evidence reduces avoidable delays.
A response SLA is not a guarantee that an application will pass its assessment or receive an LoV by a particular date.
What is a CASA Letter of Validation?
A Letter of Validation is the document issued after successful completion of the applicable security assessment. In Google's security verification program it communicates the assessment outcome and is used as evidence in the verification process.
Secusy's CASA AL1 engagement includes a signed LoV issued by ValueMentor after successful validation, together with submission to Google's Third Party Data Safety team. Purchasing an assessment does not automatically entitle an application to a successful result; required security findings must be addressed.
Google requires annual reassessment for applicable applications, and the App Defense Alliance states that certification validity is up to 365 days from issuance, subject to the relevant scheme requirements. An application's required assurance level may also change over time.
What happens after purchasing CASA AL1 through Secusy?
- Select your package and complete the online purchase.
- Submit the application and Google project details through the customer portal.
- Prepare and complete the SAQ.
- Run the integrated scanner or upload acceptable authenticated scan evidence.
- Submit the assessment materials for review.
- Resolve outstanding findings and complete any necessary retesting.
- Receive the signed LoV after successful validation.
The underlying assessment expertise is provided by ValueMentor. This pairs a self-service purchasing and onboarding experience with independent security assessment delivery.
CASA AL1 readiness checklist
Use this checklist before you buy to see how much preparation work remains. Progress is saved only in your browser and is never sent to us.
0%
0 of 12 preparation tasks completed. This is a planning aid, not an official CASA conformity score.
Ready to start your CASA AL1 assessment?
If Google has assigned your application CASA AL1, Secusy provides a digital route to select your support package, obtain an instant quote, complete onboarding and submit the required assessment evidence. CASA AL1 assessments start at $499, powered by ValueMentor.
Get your instant CASA AL1 quote
Official references: Google — Security Assessment, App Defense Alliance — CASA, App Defense Alliance — Certification and OWASP ASVS.
Frequently asked questions
What is a Google CASA AL1 security assessment?
A Google CASA AL1 security assessment is a verified self-assessment under the App Defense Alliance Cloud Application Security Assessment framework. Developers prepare application security evidence, and an authorized testing laboratory reviews it. Applications assigned AL1 by Google must complete the applicable process to obtain a Letter of Validation (LoV). Secusy CASA AL1 assessments start at $499.
Is Google CASA AL1 the same as a penetration test?
No. AL1 is a verified self-assessment in which the developer typically conducts the required testing and an authorized lab reviews the evidence. A separately commissioned penetration test may add assurance, but it does not automatically replace CASA validation.
Can my own developer perform CASA AL1 scanning?
Yes. AL1 typically permits developer-performed testing, subject to the applicable testing requirements and laboratory verification. Secusy lets customers use its integrated scanner or supply acceptable authenticated OWASP ZAP or Burp Suite evidence.
Does CASA AL1 require the Self-Assessment Questionnaire?
The questionnaire forms part of Secusy's AL1 assessment process. Complete it accurately and provide supporting evidence where required.
Can I obtain an LoV if vulnerabilities are found?
Findings that prevent successful validation must be resolved or appropriately justified and accepted through the applicable review process. Payment alone does not result in an LoV.
Can a startup complete CASA AL1 without a dedicated security team?
Yes, provided it can satisfy the assessment requirements. A startup may use its development team for customer-led preparation or purchase a managed package for additional operational assistance.
Does the CASA assessment cover my entire company?
Not automatically. CASA is an application security assessment, and its scope should reflect the application, relevant supporting components and applicable program requirements. It is not a substitute for organization-wide assurance such as an ISO 27001 audit.
Is a Google CASA assessment required every year?
Google requires annual security reassessment for applicable applications that use restricted OAuth scopes.
Should I purchase AL1 before receiving Google's notification?
Confirm the assurance level assigned to your application first. If Google has not specified your required assessment level, avoid purchasing an unsuitable package.