2

From the link Required Testing Information for the ISV Security Review

I found a section called Documentation in the above link. Do we need to submit a document described in that section.

If the Security Review Wizard has the same set of questions as mentioned in the documentation part as per the above link, will there be a need to submit a separate documentation?

Improve this question
4
  • Yes you will. .
    – Eric
    Commented Feb 2, 2017 at 8:05
  • @Eric Is there a option available to upload the documentation??
    – DOMINIC EDWARD
    Commented Feb 2, 2017 at 8:07
  • yes....there will be a way for you to upload your supporting documents and security policy
    – Eric
    Commented Feb 2, 2017 at 8:08
  • Hi @Eric, I have gone through the video as well as Security Review Trailhead . In step 6, there is an option to upload Other scanner reports or documentation. Do you mean that? We already have a Product User Manual. Thus the documentation mean User Manual or the question asked?
    – DOMINIC EDWARD
    Commented Feb 2, 2017 at 8:48

1 Answer 1

Reset to default
1

You should provide as much as information you can. There are two section to provide the documents.

  1. Scanner (Security Checks): Upload security scan document which verify that your application does not has any vulnerability.
    Just below that you will have another option of put your explanation document if scanner report found the vulnerability but it is false as per the application use case.

  2. Other documentation section is used to provide any important application details which a security engineer may ask you when they test your application. You should think and provide all use cases or technical explanation so engineer can understand the application is safe.
    This is optional but there is no harm if you have additional information and ready to provide.

Improve this answer
2
  • Thanks @Ashwani. Just for clarification, Security Review Trailhead step 3 screen what we need to submit on behalf of company?
    – DOMINIC EDWARD
    Commented Feb 2, 2017 at 11:07
  • 1
    @DOMINICEDWARD If your company has some security policies and those are also applied to application then you should provide the document explaining what information and how you are securing it. This is not mandatory.
    – Ashwani
    Commented Feb 2, 2017 at 11:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .