Level 2 (Advanced)

Across our scoping conversations and the broader market for accredited application security certification, Level 2 is the level most products ultimately certify at — it is the modal choice. It satisfies the substantive questions enterprise procurement processes typically ask (multi-role testing, source code review on critical components, business-logic evaluation), is proportionate to the median product risk profile (customer-facing, handles PII or transactions, but not banking-grade), and offers a favourable cost-benefit ratio relative to Level 3 for products that fit. We say ‘modal’ rather than ‘recommended’ because level selection should be informed, not defaulted — Section 3.8 above describes when Level 2 is the wrong choice.

At Level 2, source code review is mandatory but is conducted on a sample of the codebase rather than comprehensively. The sample is selected on a risk-driven basis — focused on critical components such as authentication, authorisation enforcement, payment processing, key management, and any component handling sensitive data classes. The selection rationale is documented in the Evaluation Report. Comprehensive (rather than sample-based) source code review across the in-scope codebase is a Level 3 activity.

Indicative starting fee is USD 4,000 onwards for small organisations certifying a single, low-complexity product on a single technology stack in a single environment, under a single Module. Final fees depend on scope, technology, codebase size and complexity. Quotations on request at /quote. Annual surveillance, change-driven re-evaluation, and recertification fees are billed separately. Fees do not influence the certification decision.

Typical Level 2 engagement: 6–12 weeks elapsed time, with Module A and Module C engagements typically running 6–11 weeks and Module B engagements 8–12 weeks (due to tenant-aware additions). Largest variable is applicant responsiveness during findings closure. Engagements with prepared documentation, well-architected products and rapid corrective-action cycles complete faster.

In most enterprise procurement contexts, yes — Level 2 satisfies the substantive vendor security questions enterprise procurement teams typically ask. Where the buyer is in banking, payments, regulated healthcare, or specifies Level 3-equivalent depth in their VSQ, Level 3 is the floor. We discuss specific procurement requirements at scoping; in our experience, Level 2 satisfies majority of enterprise procurement asks for B2B and B2C products handling customer data.

SOC 2 Type 2 is a Trust Services Criteria-based attestation issued by a CPA firm, addressing the controls of a service organisation broadly. Level 2 is an ISO/IEC 17065-accredited product certification, evaluating a specific software product against OWASP ASVS Level 2 with documented depth across 14 control families. SOC 2 is broader in operational scope; Level 2 is deeper on application security and is publicly verifiable in our directory. Mature buyers commonly ask for both. Detailed comparison is on Module B’s page (Section 3.11) at /certification/saas-security.

Yes. Upgrade engagements are scoped to the additional evaluation depth between Level 2 and Level 3 — not a full re-evaluation from zero. The existing Level 2 certification’s documentation, architecture review, sample-based source code review and prior findings are taken into account. The upgrade adds Level 3’s comprehensive source code review, formal threat-modelled architecture review, and adversarial / threat-led testing. Pricing reflects the depth gap. Quotations on request via /quote.

Recommended but not strictly mandatory. A documented threat model accelerates the Stage 1 documentation review and reduces the need for Guardian to construct an implicit threat model from interview and architecture review. Where no threat model exists, Guardian’s evaluators construct one as part of architecture review — but this adds engagement time. Level 3 requires formal threat modelling (STRIDE / PASTA) as a deliverable; Level 2 does not, but it benefits from one.

Multi-role testing means the evaluation team operates with multiple distinct user roles within the certified product — typically anonymous (unauthenticated), authenticated standard user, authenticated admin user, and any role-specific roles defined by the product (e.g., merchant vs customer in a marketplace, doctor vs patient vs admin in a healthcare portal). Authorisation paths between these roles are tested explicitly: can a standard user reach admin functions (vertical privilege escalation)? can one user reach another user’s resources (horizontal escalation, IDOR)? Level 1 tests with a single role; Level 3 adds chained-attack scenarios across roles.

Critical findings must be addressed for certification to be granted. Guardian issues the finding with technical detail and the relevant ASVS / OWASP Top 10 reference. Remediation is the applicant’s responsibility — Guardian does not provide consulting or fix-support. Guardian re-verifies corrective actions; one round of re-verification is included, additional rounds billed separately. If the product cannot meet the criteria, certification is not issued — fees for work performed are payable per the Certification Agreement, and there is no record of the failed application in the public directory.

Evaluation coverage is risk-driven, not exhaustive. The scoping discussion identifies the in-scope surface — pages, features, integrations, environments — and the Scope Statement names this boundary. Evaluation depth across the in-scope surface is comprehensive at Level 2 (full ASVS Level 2 coverage), but very large applications may be scoped to a representative subset by mutual agreement, with the boundary explicitly stated in the Scope Statement. Pricing reflects scope size.

At Level 2, change-driven re-evaluation is expected. The Certification Agreement requires notification of significant product changes — major releases, architecture changes, new authentication mechanisms, new authorisation models, breach incidents. Guardian’s Decision Authority assesses each notified change. For changes that materially affect the certified scope, a targeted re-evaluation is conducted outside the routine surveillance schedule, scoped and billed separately. Routine releases that do not materially change the certified scope are typically covered by annual surveillance.

Indicative starting fee is USD 4,000 onwards for small organisations — designed to make Level 2 accessible to growth-stage companies. Final fees depend on scope and complexity; quotations are on request. We work routinely with companies of all sizes. Where Level 2 is genuinely disproportionate to a product’s revenue stage and risk profile, Level 1 is the proportionate alternative — but for products handling customer data, transactions or sensitive workflows, Level 2 is typically what enterprise procurement asks for.

No. Sample-based source code review at Level 2 is conducted via secure remote access in your environment wherever feasible, or in a controlled environment that meets your security requirements. Source code is not retained by Guardian after the engagement closes. Confidentiality is documented in the Certification Agreement and our Confidentiality Policy at /confidentiality.

Yes. The Guardian SecureApp™ certification mark and the UAF accreditation symbol use are governed by UAF-GEN-CAB-02 and our Use of Mark Policy at /marks-policy. Display rights are the same across all three levels — the mark does not change visually based on the certification level. The certificate names the level explicitly, and the public directory entry shows the level.

Specific regulatory acceptability for any specific Indian regulator depends on the regulator’s mandate and any empanelment requirements (CERT-In empanelment is a separate accreditation under the Government of India). Level 2 produces an accredited third-party certificate against OWASP ASVS Level 2 — a recognised international benchmark. In regulated procurement processes, Level 2 typically serves as evidence alongside regulator-specific requirements rather than as a substitute. Where a regulator names Level 3-equivalent depth, Level 3 is the floor. Discuss specific regulatory drivers at scoping.