CASA (Cloud Application Security Assessment) is a security assessment framework published on the site of the App Defense Alliance (ADA). The site says that the alliance is now part of the Linux Foundation and that its Google programs, CASA among them, are still active. CASA is not software: it is a set of security requirements and a process for checking that an application meets them.
CASA is based entirely on the OWASP Application Security Verification Standard (ASVS), a public list of security controls for web applications. It targets applications that exchange data with cloud platforms through data-sharing integrations and may access sensitive user data. The framework user, for example Google, decides which assurance level an application needs, from the sensitivity of the data, the number of users and other risk factors. At assurance levels 1 and 2, an ADA-authorized lab tests and validates the requirements; level 2 also covers the deployment infrastructure and data storage. Every application must be revalidated each year, and existing certifications can shorten the checks through the CASA Accelerator.
Developers hire one of the authorized assessors; the ADA pages publish no prices.