What should be the questions asked to assess a company on web app security?

Our company is in process of partnering with another company in order to outsource web app security work to them. For us to make sure they would deliver the right assets, what questions, documents, or processes should be considered asking?

Also, the tests which they would likely do for us are black-box security assessments which include but is not limited to webapp security assessments, penetration tests, mitigation queries and answering any queries from the client if the clients does not necessarily understand the technical aspects of the security assessments conducted.

  • That's really going to depend on what you need from them.
    – schroeder
    Mar 9, 2015 at 21:23
  • yes, and as mentioned above. We would like to just clarify the initial statements and get their skills ahead before our practical signatory association. This exercise would help us know what initially we could ask!? Mar 9, 2015 at 22:38
  • You have not given us nearly enough to work with. Are they doing testing? Coding? "Security work" is undefined in your question.
    – schroeder
    Mar 9, 2015 at 22:53
  • Yes, I agree on that. They would be on vulnerability assessments and penetration tests. All of these tests would be black-box and would not be a white-box code audit. I'd change the 'security work' to something that suits the community. Mar 9, 2015 at 23:01
  • There are lots of good questionnaires online: pcicomplianceguide.org/…
    – schroeder
    Mar 9, 2015 at 23:06

1 Answer 1


I'm sorry to revive an old question, but Jacob Kaplan-Moss - co-creator of Django - recently wrote a great article about this exact subject: Our Dumb Security Questionnaire. It consists of the following ten questions:

(1) Please answer these questions:

  1. If you use a cloud provider (GCP/AWS/Azure/etc):

    • describe how credentials are provisioned, managed, and stored.
    • If an attacker gained access to an individual developer’s cloud credentials, what actions could that attacker perform, and how would you detect and respond to the breach?
  2. If you don’t use a cloud provider: why not?

  3. Describe how staff authenticate to company services (e.g. servers, email, SaaS products), particularly highlighting your use of password managers, 2FA, and SSO.

  4. What development practices do you use to protect against the OWASP Top 10?

  5. Describe the steps a developer or operations person takes to push new code to production.

  6. Have you had any security breaches in the last two years?

    • If yes: please explain the breach, and provide copies of any postmortem/root cause analysis/after-action reports.

(2) And, please provide as many of the following as possible:

  1. A recent (last 12 months) penetration test report, with information on what follow-ups/remediation steps were taken. Reports by an external firm are preferable; internal tests are OK. A redacted summary is fine as long as it includes basic vulnerability descriptions and severity levels.

  2. Documentation on your organization’s Secure Development Lifecycle, or similar, if you have them. If not, please summarize the steps you take to help engineers write secure code.

  3. A copy of any security training material provided to staff, particularly software developers. A summary/description of classes and content is fine.

  4. A link to your Vulnerability Disclosure Policy and/or bug bounty program. If you don’t have either: please explain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.