VERIFIED TIERS
Veracode Verified Standard represents that the following application security practices are embedded into the software development process:
- Assessment of first-party code using static analysis
- Documentation that the application does not allow Very High flaws in its first-party code
- Developer access to remediation guidance Verified Standard is the first of three (3) tiers representing the Verified program.
- Learn more about the Veracode Verified program by clicking here.
Veracode Verified Team builds on the security processes embedded in the development lifecycle from Verified Standard to include the following security gates:
- Assessment of open source components
- Documentation that the application does not include Very High or High flaws
- Documentation of a 60-day remediation deadline
- Identification of a Security Champion within the development team to ensure secure coding practices are used across the SDLC
- Provides training on secure coding best practices for the identified security champion
- Learn more about the Veracode Verified program by clicking here.
Veracode Verified Continuous is the highest level of the Verified program and builds on the security processes embedded in the development life cycle from Verified Team to include the following security gates:
- Integration of security tools into development workflows
- Assessment of the application using an alternate technique (ex. dynamic analysis)
- Documentation that the application does not include any Very High, High or Medium flaws
- Completion of a bi-annual mitigation review
- Documentation of a 30-day remediation deadline
- Provide advanced training on secure coding for the security champion identified on the development team.
- Provide development team with training on secure coding.
- Learn more about the Veracode Verified program by clicking here.
VERIFIED TIERS
Veracode Verified Standard represents that the following application security practices are embedded into the software development process:
- Assessment of first-party code using static analysis
- Documentation that the application does not allow Very High flaws in its first-party code
- Developer access to remediation guidance Verified Standard is the first of three (3) tiers representing the Verified program.
- Learn more about the Veracode Verified program by clicking here.
Veracode Verified Team builds on the security processes embedded in the development lifecycle from Verified Standard to include the following security gates:
- Assessment of open source components
- Documentation that the application does not include Very High or High flaws
- Documentation of a 60-day remediation deadline
- Identification of a Security Champion within the development team to ensure secure coding practices are used across the SDLC
- Provides training on secure coding best practices for the identified security champion
- Learn more about the Veracode Verified program by clicking here.
Veracode Verified Continuous is the highest level of the Verified program and builds on the security processes embedded in the development life cycle from Verified Team to include the following security gates:
- Integration of security tools into development workflows
- Assessment of the application using an alternate technique (ex. dynamic analysis)
- Documentation that the application does not include any Very High, High or Medium flaws
- Completion of a bi-annual mitigation review
- Documentation of a 30-day remediation deadline
- Provide advanced training on secure coding for the security champion identified on the development team.
- Provide development team with training on secure coding.
- Learn more about the Veracode Verified program by clicking here.
