How Much Does a Google CASA Assessment Cost?
Short answer
There is no single universal CASA price. Formal assessment cost depends on the assurance level required, which authorized lab you use, application complexity and scope, remediation and retesting, and whether existing certifications reduce duplicated work. Treat any price you see online as lab-specific and time-sensitive — verify with the assessor Google points you to.
Why there isn't necessarily one CASA price
CASA is a framework and assessment process, not a fixed SKU sold by Google at one list price. Authorized labs set commercial terms for the work they perform. Different assurance levels and scopes imply different amounts of testing.
Older blog posts may quote Tier 1 / Tier 2 style packages that no longer match current terminology or your assigned process. Prefer current instructions from Google and your lab.
What determines assessment cost?
Required assurance level (for example AL1 vs AL2 in Google’s current descriptions).
Which authorized assessor / lab you engage.
Application complexity: number of roles, APIs, environments, and data flows in scope.
Assessment scope: which URLs and interfaces are tested.
Whether you already hold certifications or evidence that map via tools like CASA Accelerator (where applicable).
Geography, scheduling urgency, and lab capacity.
Potential additional costs
Retesting after findings.
Expanding scope mid-engagement.
Extra environments or credentials setup.
Advisory or remediation consulting beyond the assessment itself.
Internal engineering time — often larger than the lab invoice.
Remediation and engineering costs
Budget for developers to fix authentication, authorization, session, crypto, logging, and transport issues the lab reports. Simple header and TLS fixes can be quick; access-control redesigns are not.
Finding straightforward issues before formal testing may reduce retest rounds, but it does not eliminate the need for an authorized assessment when Google requires one.
Does CASA need to be repeated?
Google describes annual revalidation for applications in this track. Assurance level can change as users, scopes, or data handling change. Plan for recurring assessment cost, not only a one-off project.
Can preparation reduce wasted assessment effort?
Yes, within limits. Cleaning up expired certificates, missing HSTS, insecure cookies, and obvious disclosure before the lab starts can keep the first pass focused on deeper controls.
Preparation does not replace the assessor and does not guarantee a clean report.
Readiness check vs formal assessment
Formal assessment: authorized lab fee + possible retest + your engineering time; produces validation recognized in Google’s process when successful.
Nexio Watch CASA Readiness Check: €99 one-time for an independent preparation report. It does not replace the official assessment or its cost.
Before You Pay for the Formal Assessment
Finding straightforward security issues beforehand may reduce delays and unnecessary remediation cycles. Nexio Watch’s readiness check is a one-time €99 deliverable — not a substitute for an authorized CASA assessment.
One-time payment. No subscription.
FAQ
How much does Google charge for CASA?
Google does not publish a single consumer price for CASA the way a SaaS product would. You pay an authorized assessor (and your own remediation costs) according to the process Google requires for your app.
Is €99 the cost of CASA certification?
No. €99 is Nexio Watch’s readiness check price. Formal assessment pricing is separate and set by authorized labs.
Where can I see current lab prices?
Ask the authorized labs Google or the App Defense Alliance direct you to. Published third-party price lists go stale quickly; confirm in writing for your scope and assurance level.
Will fixing issues myself lower the lab fee?
Sometimes preparation reduces retesting or delays, but base engagement fees are set by the lab and scope. Do not assume self-remediation changes the quoted assessment price unless the lab says so.
Before you buy
Nexio Watch CASA Readiness is an independent preparation service. Nexio Watch is not an App Defense Alliance authorized assessor. The readiness report does not constitute CASA certification, verification, or an official CASA assessment.