Join Us For A Special Livestream From DEF CON 30. Watch Live Friday, August 12 | 10AM - 5PM ›

Vendor Security Assessment

Google Partner Security Assessment Program

The Google Partner Security Program is a collaborative effort to protect partner, customer, and Google data by increasing the security of Google partners’ applications and networks that integrate with the Google ecosystems.

Supporting Partners and Customer Security.

Google needs to ensure that their user data is being handled securely, so they engaged Bishop Fox to design the security assessment program and conduct in-depth security testing that validates the security posture of their 1,000+ G Suite partners.

We identified four tests and reviews to comprehensively assess the G Suite partner's security posture:

  1. Application Penetration Testing
  2. External Penetration Testing
  3. Cloud Deployment Review
  4. Security Program Review

Our Google Partner security assessment validates the security of your application and ensures your user data is being handled securely.

Our goal is to help you complete the Gmail/OAuth Security Assessment requirements listed on OAuth Application Verification FAQ to obtain your annual certification.

To learn more about how Bishop Fox helps you certify your application, download our "What to Expect" guide below.

Get your security assessment started:

By submitting this form, you indicate that you have read and agree to the terms of our Privacy Policy

Bishop Fox Google Partner What to Expect Guide Security Assessment document

Helpful Resource

What to Expect Guide

Learn how Bishop Fox partners with you to validate the security of your application in our "What to Expect" Guide.

What's inside:

  • Project timeline - estimated timeline based on average engagement size
  • Scoping - how we scope your project
  • Pre-engagement - what you need to prepare in advance of the engagement
  • Fieldwork - what to expect during the test
  • Deliverables & remediation testing - what we provide at the end of the engagement

Why Bishop Fox

We helped Google build the largest and most successful public third-party ecosystem testing program ever.


Deep Experience

Our Team's technical depth and expertise means we can tailor every solution or project to your unique requirements.


We Do One Thing

Companies that specialize in offensive security provide better penetration tests than companies that propose entirely unrelated services.


Senior Attention

Senior consultants drive service delivery, and we are committed to every project’s success. You won’t be handed off to a junior team.

Aspire software case study detail
Customer Logo

See Why Aspire Chose Bishop Fox

When they needed a security assessment to meet the requirements of the Google Partner Security Program, Aspire came to Bishop Fox. Bishop Fox evaluated their application, Azure environment, and external perimeter. As a result, the Aspire team satisfied Google's requirements.


You have questions. We have answers.

How much will the assessment cost?

We have negotiated discounted pricing with Google for this program, and the cost varies depending on the size of the application, size of the environment, and how Google user data is utilized .

When will the assessment start?

Partners will need to provide full project enablement items (e.g. credentials, test accounts, documentation, etc.) before receiving a start date. This is to ensure that there are no delays to the project schedule.

How long will the assessment take?

Once all the paperwork is in place, fieldwork can typically take 1 to 4 weeks. After that, reporting and QA can take up to 1 week for report delivery. This does not include remediation time.

What will the scope of the testing be?

The focus of the penetration testing will be on the external perimeter internet-facing assets and applications that store Google user data on non-Google servers, a self-assessment questionnaire, and a cloud deployment review.

What will the scoping information be used for?

Information shared with us for scoping will be used to determine overall effort required and also shorten the ramp-up time needed for testing. If we can understand the environment before testing, we can spend less time on discovery/footprinting and more time and on active pen testing. The more accurate the scoping details are, the more accurate and cost sensitive we can be with the scope and quote.

Do I need to provide source code?

We’ll leave that up to you. If you want to provide source code, it can help us be more efficient with our time and get to a deeper level of testing. That said, source code is not required for this assessment.

How will my sensitive data be handled?

All sensitive data including source code will be stored, processed, and transmitted securely. Your Bishop Fox engagement manager can help set up a secure file share to use throughout the project.

How long does remediation take?

Last year, we found that partners took an average of 28 days to implement fixes and complete remediation testing. Of the 28 days, about 2-3 days were used for Bishop Fox to retest the findings and issue a remediation report. This is important to note in consideration of any Google-issued deadlines.

Only a small part of my application uses Google Apps. Does it all get included in the scope?

Yes. Unless Google customer data is clearly isolated from other parts of your application, we need to test the entire application. If an attacker is able to exploit one part of your application not directly related to Google, that exploit still could be used to compromise Google customer data.

We are rebuilding the application now and/or migrating it to a new infrastructure. Should we do the test now or later?

If it's possible to hold off (considering any deadlines given by Google), it would be best to have the most up-to-date version of your application and environment tested. This is to ensure we get appropriate coverage on any additional functionality or environment changes that could affect testing.

We are interested in a standard Letter of Assessment in addition to the Google Testing Letter. Does this change the scope/cost?

Yes. We will need to review the scope and determine if additional testing is required to meet our standards for a general Letter of Assessment in addition to the Google Testing Letter. If you have a particular compliance requirement, please describe it and the framework so we can consider it appropriately in scoping.

Where do I find my Google Product name and number?

The following page explains how a partner can find the project ID and project number:

Still have questions?

Chat with one of our security experts to learn how we can support your security needs.

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.