# CASA Tier 2 Checklist — [Your App Name]

> **Instructions for Claude:** Use this checklist to track progress through the CASA Tier 2 assessment. Check off items as they're completed. Search the codebase and infrastructure for evidence of each control.

---

## Phase 1: Pre-Assessment Preparation

### Documentation
- [ ] Security architecture documented
- [ ] PII data flow mapped
- [ ] OAuth scope justification written (one per sensitive scope)
- [ ] Data retention policy defined
- [ ] Incident response plan created

### Security Controls (fix before the scan)
- [ ] HTTPS enforced on all endpoints
- [ ] HSTS header configured (`Strict-Transport-Security`)
- [ ] Content Security Policy (CSP) header configured
- [ ] `X-Content-Type-Options: nosniff` set
- [ ] `X-Frame-Options: DENY` set
- [ ] `Referrer-Policy` set
- [ ] `X-Powered-By` header removed/suppressed
- [ ] CORS restricted to specific origins (not `*`)
- [ ] No external scripts without SRI or self-hosting
- [ ] Source maps disabled in production
- [ ] Debug modes disabled in production
- [ ] No sensitive data in URLs or query strings

### Authentication & Authorization
- [ ] All API endpoints require authentication
- [ ] Access control enforced server-side (not just client)
- [ ] Database-level access control (RLS or equivalent)
- [ ] Session tokens expire and refresh properly
- [ ] Logout invalidates sessions

---

## Phase 2: Vulnerability Scanning

### SAST (Static Analysis)
- [ ] Run static analysis scanner (e.g., FluidAttacks, Semgrep)
- [ ] Fix all findings
- [ ] Document remediations

**Commands:**
```bash
# FluidAttacks SAST (Docker)
docker run --rm -v "$(pwd):/src" fluidattacks/cli skims scan /src/config.yaml

# Semgrep
npx semgrep --config=auto .
```

### DAST (Dynamic Analysis)
- [ ] Receive DAST report from assessor
- [ ] Fix all Low/Medium/High findings
- [ ] Run independent verification scan

**Commands:**
```bash
# OWASP ZAP Baseline Scan
docker run --rm ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://your-app.com -J report.json

# Fluid Attacks DAST
docker run --rm -v "$(pwd):/src" fluidattacks/dast /bin/dast /src/config.yaml
```

### Dependency Audit
- [ ] Run dependency audit (`npm audit` / `pnpm audit`)
- [ ] No critical or high vulnerabilities
- [ ] Lock file committed and used in CI

---

## Phase 3: DAST Findings Remediation

> Fill in when you receive the assessor's report:

| # | Finding | Severity | Root Cause | Fix | Verified |
|---|---------|----------|-----------|-----|----------|
| 1 | [Finding name] | [Low/Med/High] | [What caused it] | [What you changed] | [ ] |
| 2 | | | | | [ ] |
| 3 | | | | | [ ] |

### Verification
- [ ] Playwright/E2E tests written for each finding
- [ ] All tests pass against production
- [ ] Independent ZAP scan shows 0 failures
- [ ] Remediation report generated

---

## Phase 4: Self-Assessment Questionnaire (SAQ)

- [ ] All 54 questions answered
- [ ] Each answer references specific code/config files
- [ ] Compliant items have technical justification
- [ ] N/A items have clear explanation
- [ ] Partially compliant items have mitigation plan

---

## Phase 5: Supporting Documentation

- [ ] Remediation report (finding → fix → evidence)
- [ ] Encryption documentation with code snapshots
- [ ] Database screenshot showing encrypted data
- [ ] Scan results (ZAP, Fluid Attacks, or equivalent)
- [ ] Playwright test results

---

## Phase 6: Submission & Revalidation

- [ ] All findings remediated
- [ ] SAQ submitted
- [ ] Supporting documentation sent to assessor
- [ ] Assessor follow-up questions answered
- [ ] Revalidation scan passed
- [ ] CASA verification confirmed
- [ ] Google OAuth console updated

---

## Phase 7: Ongoing Compliance

- [ ] Annual revalidation date noted: [Date]
- [ ] Dependency audit scheduled (monthly)
- [ ] Security header monitoring in place
- [ ] Incident response plan reviewed annually