Questionnaire

Getting Started

Work Email *

Please select the Google Cloud Application Security Assessment you are pursuing: *

Gmail
Drive
Chat
Data Portability
Google FIT
Google Health
Photo Ambient
Google Workspace Security Badge, AL2 Only
Other

If "Other" please which Google Application Security Assessment

Did you pass OAuth Security Assessment or CASA last year? *

Yes
No, this will be our first time

Has Google directed you to undergo a CASA Review? If yes, what is your Assurance Level (AL) Assignment? * If yes, NCC Group will require a copy of the email to 'google_casa@nccgroup.com'. Completing a CASA Review before Google has directed you to do so could result in a rejected LOV.

Yes, AL1
Yes, AL2
No, but we know it is required and are getting a head start on the process
No, we are Self-Initiating

Indicate all Google Restricted Scopes being used by your application/integration. * All current restricted scopes can be found here: https://support.google.com/cloud/answer/13464325

Your Company Information

Your Company Name (full name incl. Inc, LLC, etc.) *

DUNS Number *

Your Company Mail/Postal Address 1 (This is required for the LOA issuance): *

Address 2:

City:

State/Providence: *

Country: *

Zip Code: *

Corporate website address * Type your company's website address

Corporate phone number *

Technical point of contact name: *

Technical point of contact email: *

Is the invoicing address the same as the company address provided* (If NO, please notify your NCC Group representative upon follow up) *

Yes
No

About your Application

Google Project Number (NOT the "Project ID" or "Project Name". This should be a 12-digit number): * If you have multiple project numbers, please include an explanation of how each project number is utilized (Different applications, environments, platforms, regions, etc) .

Please state your LOV deadline, as provided by Google. * If a date was not provided, please input date 90 days from the date you received your last comms from Google.

Application Name and Version Number *

Publicly Available Application URL: *

Server Application Type(s) -- please select any of the following if directly exposed to the internet: *

Open API-compatible REST API
Other REST API
SOAP API
GraphQL API
Web Sockets App
Other API (please list below)
Other server app type (please list below)

If "Other" please list:

Client Application Type(s) -- please select all that apply: *

Web App with UI (including most/all Google functionality)
No Web App with UI (Or with no/limited Google functionality) (Please describe how your application integrates with Google and on what platforms below)
Android app
iOS app
Desktop app
Browser Extension
Add-On
API
Other (please list below)

If you indicated "No Web App with UI (or with no/limited Google functionality)", please describe how your application integrates with Google and on what platforms.

If 'Other' was selected in the previous question, please list:

If 'Android' or 'iOS App' indicated in previous question, can the OAuth flow be completed within the mobile app/web app?

Mobile: Yes
Mobile: No
Web: Yes
Web: Yes

Can you give a brief description of the application, how it uses Google user data, where it’s stored, how it’s transferred, and flows through your cloud architecture? *

What is the size of the full application (total endpoints, APIs + App)? *

1 – 250
251 – 700
701 – 1200
>1201

Best numeric estimate of total endpoints? *

Does your application make use of Multi-Factor Authentication (MFA) for application end users (not administration)? If yes, can it be disabled for specific test accounts? *

No, we do not use MFA for end users
Yes, we use MFA and can disable it for testing/test users
Yes, we use MFA but we CANNOT disable it for testing/test users

Are you intertested in additional pentesting services? The Cloud Application Security Assessment to be completed by NCC Group is designed to determine if an application meets all of the App Defense Alliance requirements. This assessment is not, however, to be a full and complete penetration test of the application and should not be treated as such. As a separate engagement NCC Group can perform additional security services. Are there any pentesting efforts you are interested in?

Network/Infrastructure Testing
Web Application Assessment
Cloud Configuration Review
Other compliance or regulatory assessment(s)

CASA Questionnaire