Your CASA assessment.
Consider it handled.
Google asked you to complete a CASA security assessment? Let PlaidNox handle the coordination and paperwork. Our specialists include professionals who previously served as CASA assessors at authorized labs. We prepare documentation on your behalf and guide you through sharing only the necessary information and evidence, so your team can focus on its product.
Experience figures reflect the cumulative hands-on CASA work of our specialists across their careers, including roles at authorized assessment labs.
Your CASA journey
One point of contact, four clear stages
Share required facts and evidence through a short call, email, or another agreed secure channel. We draft the documents; you review, approve, authorize access, and make any needed fixes.
Assess requirements
We review your Google or ADA notification and scope.
We prepare your documentation
You share key inputs; we draft the assessment documents and coordinate the lab.
Support testing and fixes
We manage technical follow-ups and remediation tracking.
Guide validation to closure
The authorized assessor issues the Letter of Validation once criteria are met.
What we manage
Everything complicated about CASA, in one place
From writing assessment documentation to coordinating the authorized lab, our specialists manage the workload and guide you through each required input.
Requirement and scope review
We interpret your assessment notice, requested OAuth scopes, project details, assurance level, and deadline to define a clear action plan.
Authorized assessor coordination
We help identify a suitable authorized assessment lab, coordinate scoping and scheduling, and manage communications and follow-ups.
Documentation done for you
We draft questionnaires, required documentation, technical explanations, and evidence mappings on your behalf. You provide the facts and evidence, and review the finished materials before submission.
Application security guidance
We help review likely assessment blockers, interpret security requirements, and organize any agreed pre-assessment technical checks.
Findings and remediation management
We translate assessor findings into actionable developer tasks, track progress, and coordinate evidence and retesting requests.
Validation and renewal support
We coordinate final submissions and closure activity, and help you plan the next annual revalidation cycle.
Required security assurance, without the operational burden
Cloud Application Security Assessment (CASA) is an App Defense Alliance security assessment framework used in Google's review of applications that request certain restricted OAuth scopes.
Its requirements are based on OWASP ASVS and emphasize secure handling of user data. Google determines the applicable assessment pathway and may require independent assessment and annual revalidation.
- Applicable assessments may use AL1 or AL2 assurance levels.
- An authorized assessor independently validates applicable requirements.
- After a successful assessment, the assessor can issue a Letter of Validation (LoV).
We write the paperwork. You share the essentials.
We prepare the assessment documentation on your behalf and guide you on exactly which information or evidence is needed. Send it through calls, email, or your preferred agreed secure communication channel. We handle the drafting, assessor conversations, and follow-ups; you review and approve the final submissions.
How it works
A simple path through a complex assessment
One plan, one coordinating team, clearly defined milestones.
- 1
Share your assessment request
Forward the Google or ADA notice, scope details, and deadline. We review what is required and flag any missing prerequisites.
- 2
We set the plan and lab engagement
We align the scope, engagement model, authorized assessor, commercial arrangements, and assessment schedule with you.
- 3
We draft everything and guide your inputs
We prepare the documents, questionnaires, and evidence mapping, tell you what to share over a quick call or secure channel, then coordinate testing and updates with the assessor.
- 4
We drive findings to closure
We track fixes and retesting, support final evidence delivery, and follow through with the authorized assessor on validation status.
All we need from your team: a point of contact, accurate application information and supporting evidence, required testing access, and review or approval of documentation and scope. We tell you exactly what to provide and can collect details over a quick call, email, or an agreed secure channel. You remain responsible for any necessary application fixes.
Why PlaidNox
You build the product. We handle the assessment journey.
Our specialists include former assessors from authorized CASA labs. We put that hands-on experience to work preparing your documentation and managing the journey, without claiming to be an authorized lab ourselves.
Former CASA lab assessors
Our team includes professionals who previously performed CASA assessments within authorized labs and understand assessor expectations firsthand.
We prepare the documentation for you
We draft the necessary materials from information you supply and guide you on every evidence request. No need to learn the paperwork yourself.
Simple communication, your way
Share inputs via short calls, email, or an agreed secure channel. We manage lab conversations, technical follow-ups, and next actions.
Transparent independence
Independent assessment and any Letter of Validation remain with the authorized assessor.
Who we help
Built for teams that need CASA completed, not another project to manage
Whether this is your first assessment or your annual renewal, we work around your product, team, and timeline.
- SaaS companies integrating with Google Workspace or other applicable Google APIs
- Application owners who received a Google CASA security assessment notification
- Engineering teams seeking help with evidence and remediation
- Businesses preparing for annual CASA revalidation
Transparent independence. PlaidNox is not a Google-authorized CASA assessment lab and does not issue Letters of Validation. We provide independent consulting, documentation preparation, and end-to-end coordination. Required formal testing, independent validation, and any Letter of Validation are performed or issued by an appropriately authorized assessment lab, and Google makes its own verification decisions.
Frequently asked questions
No guesswork. Clear answers.
No. PlaidNox provides independent consulting, preparation, and end-to-end assessment coordination. Required formal testing, independent validation, and any Letter of Validation are performed or issued by an appropriately authorized assessment lab. PlaidNox does not issue CASA validation letters or represent itself as Google-authorized.
Received a CASA notification? Consider it handled.
Forward your Google or ADA notice and deadline. We review what is required, set a realistic plan, and manage the journey through to validation.