CASA-Authorized Security Assessor for Google OAuth

# CASA-Authorized Security Assessment Provider for Google OAuth Verification ## Project Overview We are seeking a **currently authorized Cloud Application Security Assessment (CASA) provider** to complete the required security assessment for our SaaS application as part of Google’s OAuth verification process. Our Google integrations and OAuth implementation are already developed. We need an independent, authorized assessment organization to: * Evaluate the application against the applicable CASA requirements * Identify security or compliance gaps * Validate remediation * Complete the required assessment documentation * Issue the applicable **Letter of Validation (LOV)** or equivalent validation documentation This engagement is specifically for an **authorized CASA assessment provider**. We are not seeking an individual developer, penetration tester, or general security consultant. ## Scope of Work The selected provider will: * Confirm the applicable CASA assessment scope and requirements. * Review our application architecture and deployment environment. * Assess authentication, authorization, and identity-management controls. * Review our OAuth 2.0 and OpenID Connect implementation. * Evaluate requested Google OAuth scopes and the handling of Google user data. * Review APIs, data flows, data storage, encryption, retention, and deletion practices. * Assess cloud, web application, and API security controls. * Conduct the required vulnerability and security testing. * Identify security vulnerabilities, control gaps, and remediation requirements. * Provide clear, actionable remediation guidance to our engineering team. * Retest identified issues after remediation. * Complete all required CASA reports and validation documentation. * Issue the required Letter of Validation or equivalent documentation following successful completion. * Support reasonable follow-up questions or clarification requests during Google’s verification process. ## Required Qualifications The provider must: * Be a **currently authorized CASA assessment provider or App Defense Alliance-approved security assessor**. * Have demonstrated experience completing CASA assessments for Google OAuth applications. * Be authorized to issue the required CASA validation documentation. * Have strong expertise in: * Application and web security * OAuth 2.0 and OpenID Connect * API security * Cloud security * Identity and access management * Data protection and privacy * Vulnerability assessment and remediation validation * Have experience working with Google OAuth verification and Google API integrations. * Be able to provide formal assessment reports, remediation findings, retesting, and final validation documentation. * Communicate clearly and work directly with our engineering team throughout the engagement. ## Preferred Experience Preference will be given to providers with experience assessing: * Multi-tenant SaaS and enterprise applications * Google Drive * Gmail * Google Sheets * Google Calendar * Microsoft 365 * Salesforce * Other enterprise third-party API integrations Experience supporting clients through the complete Google OAuth verification process is strongly preferred. ## Expected Deliverables * Assessment scope and requirements confirmation * Initial CASA security assessment * Vulnerability and security-testing results * Detailed findings and remediation recommendations * Retesting following remediation * Final CASA assessment report * Letter of Validation or other required CASA validation documentation * Reasonable submission support and clarification assistance, if requested by Google ## Proposal Requirements Please include the following in your proposal: 1. Confirmation that your organization is currently authorized to perform CASA assessments. 2. The name under which your organization is listed as an authorized assessor. 3. Relevant experience completing CASA assessments for Google OAuth applications. 4. Examples of similar assessments completed, with confidential information removed. 5. Your proposed methodology and assessment scope. 6. Expected timeline for the initial assessment, retesting, and final validation. 7. Fixed-price estimate or detailed fee structure. 8. Any additional charges that may apply for retesting or remediation cycles. 9. Information, documentation, credentials, and access required from our engineering team. 10. Your earliest available start date. Please begin your proposal with **“CASA Authorized”** and include evidence of your current authorization. Proposals from general security consultants or individual developers without active CASA authorization will not be considered.