ASSURANCE LEVELS HUB

Level selection should follow your risk profile, regulatory baseline and customer expectations. Use the five-question framework in Section 3.3 above. As a default heuristic: Level 1 for low-risk internal or public-information products; Level 2 for customer-facing products handling personal data, transactions or sensitive workflows; Level 3 for products handling financial transactions, regulated data, or that are part of critical infrastructure. Where in doubt, scoping conversation maps your specifics to a proportionate level — but the decision remains a business decision, not a recommendation we make on your behalf.

Yes. Upgrade is the natural lifecycle path. The upgrade engagement is scoped to the additional evaluation depth required between your existing level and the target level — not a full re-evaluation from zero. The existing certification’s documentation review and historical findings are taken into account. Pricing reflects the evaluation man-days for the depth gap.

Yes — within a single combined-module engagement. A combined Module A + B + C engagement is conducted at one assurance level (typically Level 2 or Level 3). However, you can hold separate certificates at different levels for different products: a Level 2 certificate on your customer-facing SaaS and a Level 3 certificate on your payment API, for example, are two distinct certificates with two distinct levels.

Guardian SecureApp™ Levels map directly to OWASP ASVS verification levels. Level 1 (Basic) corresponds to ASVS Level 1; Level 2 (Advanced) to ASVS Level 2; Level 3 (High-Risk / Critical) to ASVS Level 3. The procedural framing (ISO/IEC 17065-accredited issuance, public directory listing, surveillance, complaints and appeals) is added on top of the ASVS technical content.

No. No certification level is a guarantee against future compromise. Level 3 means the product has been evaluated at the highest depth available under the scheme — comprehensive manual + threat-led methodology, comprehensive source code review, threat-modelled architecture review — and met the certification criteria at evaluation. Surveillance and recertification exist precisely because security is dynamic. What Level 3 provides is the highest available assurance signal under our scheme, not a guarantee of impregnability.

Yes. Some regulators mandate specific assurance levels for products in their jurisdiction. Where a regulator names a level, that level is your minimum. Where the regulator names criteria but not a specific level, scoping conversation helps map regulatory criteria to a Guardian SecureApp™ level. We discuss specific regulatory drivers at scoping; the certification scheme itself is regulator-agnostic, which is essential to maintaining our accreditation scope.

Change-driven surveillance is surveillance triggered by significant changes to the certified product — major releases, architecture changes, new authentication paths, new authorisation models, breach incidents — outside the routine surveillance schedule. The Certification Agreement requires the certified client to notify Guardian of significant changes; Guardian determines whether the change requires Stage 2 re-evaluation or can be addressed through routine surveillance. Levels 2 and 3 include change-driven surveillance; Level 1 is notification-only for changes.

Different Modules have different evaluation surface and methodology. Module A (Web) and Module C (API) are typically faster than Module B (SaaS / multi-tenant) at the same level, because Module B includes the underlying Module A scope plus the six tenant-aware evaluation areas. Combining modules on a single engagement extends the timeline further but is more efficient than running them serially as separate engagements.

Yes. Level 1, Level 2 and Level 3 are all accredited under ISO/IEC 17065 by UAF — accreditation is at the scheme level, not at the level granularity. A Level 1 certificate carries the full procedural integrity of accredited issuance: independent decision-making, public directory listing, surveillance, complaints and appeals rights, and recognition through the international accreditation infrastructure. What differs across levels is the depth of technical evaluation — not the procedural integrity of the certification.

It’s possible, but not recommended as a workflow. Level 1 requires committed evaluation by competent evaluators and an independent certification decision; it is not a ‘pilot’ of the full process. If your goal is to validate scoping and process before committing to Level 2, scoping conversation and a pre-application enquiry at /quote provides that orientation more efficiently than an actual Level 1 engagement.

Levels are scheme-defined and not parameterisable. There is no ‘Level 2.5’. If your product needs more depth than Level 2 but does not justify Level 3, the practical answer is to scope a Level 2 engagement with explicit scope expansions in defined areas (e.g., comprehensive source code review on a specified module, even though Level 2 baseline is sample-based). This is captured in the Scope Statement and reflects in the Evaluation Report. The certificate is still issued at Level 2 — but the underlying evaluation reflects the expanded scope. Discuss specifics at scoping.

The Guardian SecureApp™ certification mark is the same across all levels. The certificate itself names the level; mark display rules per the Use of Mark Policy do not require the level to be visually distinguished in mark usage. However, your certificate (and the public directory listing) clearly names the level — a customer who clicks through to verify the certificate sees the level immediately.

Yes. The certificate names the level; the public directory entry names the level; any procurement-grade verification will show the level. There is no ‘private’ certification level — transparency about level is part of what makes the scheme procurement-grade.

No. Surveillance fees scale with surveillance depth and frequency, which scale with level. Level 1 surveillance is annual with targeted depth; Level 2 is annual with broader depth; Level 3 is semi-annual with substantial depth and threat-model refresh. Surveillance fees are billed annually in advance and are quoted as part of the initial engagement quotation. Full fee detail at /process/fees.

Recertification is a comprehensive re-evaluation against the current version of the scheme criteria, regardless of how much the product has changed. If the product has changed materially, the recertification engagement is scoped to evaluate the current state of the product — not to compare against the prior certified state. New findings may emerge that did not exist at initial certification. Recertification is required for continued certification beyond the cycle expiry; it is not optional.

Accreditation under ISO/IEC 17065 by UAF applies to the certification scheme as a whole, not to specific levels within it. UAF is a member of the IAF and a signatory to the IAF MLA; the MLA scope varies by accreditation type. To check the current scope of UAF’s IAF MLA recognition for product certification, please verify directly on the IAF portal at www.iaf.nu. International recognition through the MLA, where applicable, applies at the accreditation level — not differently for different scheme levels.