How to find a verification provider - Revision history

Wichers at 14:14, 8 May 2009

2009-05-08T14:14:47Z

Deleted user at 03:22, 15 February 2009

2009-02-15T03:22:00Z

Deleted user at 17:50, 9 February 2009

2009-02-09T17:50:33Z

Deleted user: How to Find a Verification Provider moved to How to find a verification provider

2009-02-09T12:59:17Z

How to Find a Verification Provider moved to How to find a verification provider

Deleted user at 04:12, 8 February 2009

2009-02-08T04:12:29Z

Deleted user: Verification Providers moved to How to Find a Verification Provider

2009-02-08T00:18:08Z

Verification Providers moved to How to Find a Verification Provider

Deleted user at 23:48, 7 February 2009

2009-02-07T23:48:28Z

Deleted user at 22:01, 6 February 2009

2009-02-06T22:01:07Z

Deleted user: New page: '''THIS ARTICLE IS A DRAFT''' == Overview == One of the main objectives of the OWASP Application Security Verification Standard (ASVS) is to provide a basis for specifying web appl...

2009-02-06T21:49:38Z

New page: '''THIS ARTICLE IS A DRAFT''' == Overview == One of the main objectives of the OWASP Application Security Verification Standard (ASVS) is to provide a basis for specifying web appl...

New page

'''THIS ARTICLE IS A DRAFT'''

== Overview ==

One of the main objectives of the [[OWASP Application Security Verification Standard]] (ASVS) is to provide a basis for specifying web application security verification requirements in contracts. The [[OWASP Secure Software Contract Annex]] has in fact been updated to make use of the ASVS. Where can one go to find a business that you can call on to perform an OWASP ASVS verification? The answer is here, in this very article. This article contains a registry of businesses that perform application security verifications according to OWASP ASVS. These businesses are called “verification providers”.

Verification providers listed below have made a commitment to perform application security verifications according to OWASP ASVS requirements. Verification providers listed below are not accredited by OWASP. Neither their products or services have been endorsed by OWASP. OWASP has also not made a determination as to the business’ quality or competency in performing services. Businesses are under no obligation to seek inclusion in the list below in order to perform application security verifications according to OWASP ASVS.

== How to Add Your Company to the Verification Provider Registry ==

Verification providers listed below have made a commitment to make a good faith effort to resolve any consumer complaints that are specific to their use of the OWASP ASVS to perform application security verifications. This verification provider registry is made available to OWASP Organizational Supporters as an Organizational Supporter benefit, although an additional fee is paid for monitoring and for support of OWASP listing services to the public.

Verification providers listed below also have submitted to OWASP sample verification reports that have been reviewed to ensure that all of the information required by OWASP ASVS reporting requirements is being included in a given provider’s reports. Buyers should not necessarily expect verification reports to be provided in the sample however as the required content may be added to an existing or alternate report structure than the sample. Please see the article [http://www.owasp.org/index.php/How_to_meet_verification_reporting_requirements How to meet verification reporting requirements] for more detail.

== How to File a Complaint Against a Registered Verification Provider ==

If you are a customer of a verification provider listed below, and if a verification report provided to you does not include the required content according to OWASP ASVS reporting requirements, you can enlist the OWASP Foundation to forward a complaint on your behalf to the verification provider. In some cases, the OWASP may contact you for additional information about your complaint. OWASP will then forward the complaint to the company involved. Occasionally, OWASP may be unable to obtain any cooperation from the company. In extreme cases, OWASP may de-list the verification provider from the registry in this article. Please note that we only take complaints on companies that are OWASP Organizational Supporters.

== Verification Provider Registry ==

[http://www.boozallen.com Booz Allen Hamilton]
8283 Greensboro Drive
McLean, Virginia 22102-3828
POC: Mr. Mike Boberski
Phone: (703) 377-0456
Email: [mailto:boberski_michael@bah.com Mike Boberski]
ASVS Levels Available: 1A, 1B, 2A, 2B, 3
Markets Served: Government

[[Category:OWASP Application Security Verification Standard Project]]
[[Category:How To]]

@@ Line 25: / Line 25: @@
 *ASVS Levels that your company performs (Select one or more: 1A, 1B, 2A, 2B, 3, 4)
 *Markets served (Select one or both: Commercial, Government)
 == How to File a Complaint Against a Registered Verification Provider ==
 If you are a customer of a verification provider listed below, and if a verification report provided to you does not include the required content according to OWASP ASVS reporting requirements, you can enlist the OWASP Foundation to forward a complaint on your behalf to the verification provider.
 '''To File a Complaint:'''
 Contact: [mailto:kate.hartman@owasp.org Kate Hartman].  Provide the following information:
@@ Line 45: / Line 39: @@
 In some cases, the OWASP may contact you for additional information about your complaint. OWASP will then forward the complaint to the company involved. Occasionally, OWASP may be unable to obtain any cooperation from the company. In extreme cases, OWASP may de-list the verification provider from the registry in this article. Please note that we only take complaints on companies that are OWASP Organizational Supporters.

@@ Line 14: / Line 14: @@
-Verification providers listed below also have submitted to OWASP sample verification report templates. The outlines in the samples have been reviewed to ensure that all of the information required by OWASP ASVS reporting requirements is being included. Please see the article [http://www.owasp.org/index.php/How_to_meet_verification_reporting_requirements How to meet verification reporting requirements] for more detail.
+'''To Add Your Company:'''
@@ Line 22: / Line 35: @@
-Contact: [mailto:kate.hartman@owasp.org Kate Hartman].
+'''To File a Complaint:'''
-*Provide your name and phone number.
-*Identify the verification provider
-*Identify the OWASP ASVS Level
+Contact: [mailto:kate.hartman@owasp.org Kate Hartman].  Provide the following information:
-*Identify the missing verification report section(s)
+*Your name and phone number.
@@ Line 42: / Line 58: @@
   ASVS Levels Available: 1A, 1B, 2A, 2B, 3
   Markets Served: Government
-  Sample Report: [http://www.owasp.org/images/2/24/Booz_Allen_Verification_Report_Template.doc Sample Verification Report Template]
+  <s>Sample Report: [http://www.owasp.org/images/2/24/Booz_Allen_Verification_Report_Template.doc Sample Verification Report Template]</s>
 [[Category:OWASP Application Security Verification Standard Project]]
 [[Category:How To]]

← Older revision		Revision as of 04:12, 8 February 2009
Line 19:		Line 19:
	== How to File a Complaint Against a Registered Verification Provider ==		== How to File a Complaint Against a Registered Verification Provider ==

−	If you are a customer of a verification provider listed below, and if a verification report provided to you does not include the required content according to OWASP ASVS reporting requirements, you can enlist the OWASP Foundation to forward a complaint on your behalf to the verification provider. In some cases, the OWASP may contact you for additional information about your complaint. OWASP will then forward the complaint to the company involved. Occasionally, OWASP may be unable to obtain any cooperation from the company. In extreme cases, OWASP may de-list the verification provider from the registry in this article. Please note that we only take complaints on companies that are OWASP Organizational Supporters.	+	If you are a customer of a verification provider listed below, and if a verification report provided to you does not include the required content according to OWASP ASVS reporting requirements, you can enlist the OWASP Foundation to forward a complaint on your behalf to the verification provider.
		+
		+
		+	Contact: [mailto:kate.hartman@owasp.org Kate Hartman].
		+	*Provide your name and phone number.
		+	*Identify the verification provider
		+	*Identify the OWASP ASVS Level
		+	*Identify the missing verification report section(s)
		+
		+
		+	In some cases, the OWASP may contact you for additional information about your complaint. OWASP will then forward the complaint to the company involved. Occasionally, OWASP may be unable to obtain any cooperation from the company. In extreme cases, OWASP may de-list the verification provider from the registry in this article. Please note that we only take complaints on companies that are OWASP Organizational Supporters.

← Older revision	Revision as of 12:59, 9 February 2009
(No difference)

← Older revision	Revision as of 00:18, 8 February 2009
(No difference)

@@ Line 11: / Line 11: @@
 == How to Add Your Company to the Verification Provider Registry ==
-Verification providers listed below have made a commitment to make a good faith effort to resolve any consumer complaints that are specific to their use of the OWASP ASVS to perform application security verifications. This verification provider registry is made available to OWASP Organizational Supporters as an Organizational Supporter benefit, although an additional fee is paid for monitoring and for support of OWASP listing services to the public.
+Verification providers listed below have made a commitment to make a good faith effort to resolve any consumer complaints that are specific to their use of the OWASP ASVS to perform application security verifications. This verification provider registry is made available to OWASP Organizational Supporters as an Organizational Supporter benefit.
-Verification providers listed below also have submitted to OWASP sample verification reports that have been reviewed to ensure that all of the information required by OWASP ASVS reporting requirements is being included in a given provider’s reports. Buyers should not necessarily expect verification reports to be provided in the sample however as the required content may be added to an existing or alternate report structure than the sample. Please see the article [http://www.owasp.org/index.php/How_to_meet_verification_reporting_requirements How to meet verification reporting requirements] for more detail.
+Verification providers listed below also have submitted to OWASP sample verification report templates. The outlines in the samples have been reviewed to ensure that all of the information required by OWASP ASVS reporting requirements is being included. Please see the article [http://www.owasp.org/index.php/How_to_meet_verification_reporting_requirements How to meet verification reporting requirements] for more detail.
@@ Line 32: / Line 32: @@
   ASVS Levels Available: 1A, 1B, 2A, 2B, 3
   Markets Served: Government
-  Sample Report: <link to uploaded file here>
+  Sample Report: <link to uploaded template here>
 [[Category:OWASP Application Security Verification Standard Project]]
 [[Category:How To]]