Questionnaire

Work Email *

1.) Please select the Google Cloud Application Security Assessment you are pursuing: *

Gmail

Chat

Drive

Recommended for Google Workspace (By Google Invitation Only)

Google Fitbit

Google FIT

Google Workspace Security Badge

2.) Did you pass OAuth Security Assessment or CASA last year? *

Yes

No, this will be our first time

3a.) Confirm: You have been directed by Google to perform a Security Assessment? *

Yes (Required: If “Yes”, send a copy of the message from Google to 'google_casa@nccgroup.com' confirming this)

No

3b.) If YES to the previous question, what is your Tier Assignment? Recommended for Google Workspace and Google Workspace Security Badge Applications must undergo a Tier 3 Assessment. *

Tier 2

Tier 3

4.) Indicate all Google Restricted Scopes being used by your application/integration. *

5.) Your Company Name (full name incl. Inc, LLC, etc.) *

6.) Your Company Mail/Postal Address 1 (This is required for the LOA issuance): *

Address 2:

Country: *

City:

State/Providence: *

Zip Code: *

Is the invoicing address the same as the company address provided* (If NO, please notify your NCC Group representative upon follow up) *

Yes

No

7a.) Technical point of contact name: *

7b.) Technical point of contact email: *

8.) Google Project Number (NOT the Project ID or Project Name): *

9.) Please state your app’s deadline for Security Re-Assessment as provided by Google (mm/dd/year). If not applicable, please put 00/00/0000 *

10.) Application Name: *

11.) Publicly Available Application URL: *

12a.) Server Application Type(s) -- please select any of the following if directly exposed to the internet: *

Open API-compatible REST API

Other REST API

SOAP API

GraphQL API

Web Sockets App

Other API (please list below)

Other server app type (please list below)

13a.) Client Application Type(s) -- please select all that apply: *

Web App with UI (including most/all Google functionality)

No Web App with UI (Or with no/limited Google functionality) (Please describe how your application integrates with Google and on what platforms below on '13c')

Android app

iOS app

Chrome Extension

Thick Client or Electron App

Device

Other (please list below)

13b.) If 'Other' was selected in the previous question, please list:

13c.) If 'No Web App with UI (Or with no/limited Google functionality)' was selected, please describe how your application integrates with Google and on what platforms:

14a.) If 'Android' or 'iOS App' indicated in previous question (13a), Can the OAuth flow be completed within the mobile app?

Yes

No

14b.) If 'Android' or 'iOS App' indicated in previous question (13a), can the OAuth flow be completed within the web app

Yes

No

15.) Can you give a brief description of the application, how it uses Google user data, where it’s stored, how it’s transferred, and flows through your cloud architecture? *

16.) For web apps, approximately how many unique interactions or flows are there? (e.g. create user, update user) *

16a.) What is the size of the full application (total endpoints, APIs + App)? *

1 – 250

251 – 700

701 – 1200

>1201

16b.) Best numeric estimate of total endpoints? *

17a.) Does your application make use of Multi-Factor Authentication (MFA) for application end users (not administration)? *

Yes

No

17b.) If YES, can it be disabled to allow automated testing

Yes

No

18a.) Does your application make use of any of Application Defenses such as IPS, IDS, WAFs, stateful firewalls, etc.? *

Yes

No

18b.) If YES, Can this be disabled or an allowlist added for specific test accounts/IPs?

Yes

No

19.) Tier 3/Recommended for Google Workspace Cloud Application Security Assessments require access to source code. Please select how this can be provided: (Tier 2, no source code required): *

All Application Source Code

Snippets of Source Code Upon Request

No Source Code Shared

20.) This assessment is not a full and complete penetration test of the application and should not be treated as such. As a separate engagement NCC Group can perform additional security services. Are there any pentesting efforts you are interested in? *

Network/Infrastructure Testing

Advanced Web Application Assessment

Cloud Deployment Review

Other compliance or security assessment(s)

CASA Questionnaire