# CASA Tier 2 Security Template Pack

Templates for passing Google CASA Tier 2 verification using Claude (or any AI assistant).

## How to Use

1. Copy these templates into your project's `docs/security/` directory
2. Open each template with Claude and say: **"Fill this out by searching my codebase for evidence"**
3. Claude will search your actual code, find implementations, and write accurate answers

## Templates Included

| Template | Purpose | When to Use |
|----------|---------|-------------|
| `SECURITY-ARCHITECTURE-TEMPLATE.md` | Document trust boundaries, auth, and data protection | Pre-assessment prep |
| `PII-DATA-FLOW-TEMPLATE.md` | Map all personal data flows | SAQ questions, GDPR |
| `CASA-TIER-2-CHECKLIST-TEMPLATE.md` | Track the entire CASA process | Throughout assessment |
| `SAQ-TEMPLATE.md` | Answer all 54 security questions | Assessor submission |
| `DAST-REMEDIATION-TEMPLATE.md` | Document findings and fixes | After DAST scan |
| `ENCRYPTION-DOCUMENTATION-TEMPLATE.md` | Document encryption with code snapshots | Assessor follow-ups |
| `DATA-RETENTION-POLICY-TEMPLATE.md` | Define retention and deletion | GDPR compliance |
| `OAUTH-SCOPE-JUSTIFICATION-TEMPLATE.md` | Justify each sensitive scope | Google submission |
| `INCIDENT-RESPONSE-PLAN-TEMPLATE.md` | Security incident procedures | Compliance requirement |

## Pro Tips

- **Let Claude read your actual code.** Don't describe your architecture — point at the files.
- **Run scans before the assessor does.** Fix CORS, security headers, and SRI issues proactively.
- **The SAQ goes faster when Claude searches for evidence.** Each answer should reference real files.
- **Keep everything in version control.** Assessors appreciate auditable documentation.

## Common Quick Wins (Fix Before Your Scan)

```bash
# Check your security headers
curl -sI https://your-app.com | grep -iE "strict-transport|content-security|x-frame|x-content-type|referrer-policy|x-powered"

# Check CORS
curl -sI -H "Origin: https://evil.com" https://your-app.com | grep -i "access-control"

# Run OWASP ZAP baseline
docker run --rm ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t https://your-app.com
```

---

*From the blog post: [How We Passed Google CASA Tier 2 in a Weekend](../how-we-passed-google-casa-tier-2-with-claude.md)*