Built-in security policies
To help organizations begin evaluating their applications against security standards, we provide pre-configured built-in policies that you can assign to your applications or assign to your SCA agent workspaces.
Built-in policies are available for Static Analysis, Dynamic Analysis, and SCA Agent-based Scan.
You can set a built-in policy as the default policy for newly created applications or workspaces.
The constraints are pre-defined in the built-in policies, which you can't change, but you can create a copy of a built-in policy, to create a custom policy, and configure the constraints in the copy.
Veracode built-in policies
The following table lists the policies that Veracode provides by default. You can start scanning applications against these policy requirements immediately. After your teams are familiar with these policies, create your own custom policies.
| Policy name | Requirement | Scan requirement |
|---|---|---|
| Veracode Policy - Disallow Critical | Very High (Critical) are not allowed | Any (semi-annually) |
| Veracode Policy - Disallow High and above | High and above are not allowed | Any (semi-annually) |
| Veracode Policy - Disallow Medium and above | Medium and above are not allowed | Any (semi-annually) |
| Veracode Policy - Mobile | Specific CWEs are not allowed | Static (quarterly) |
| Veracode Policy - SCA Agent default | Low and above are not allowed | Any (once) |
| Compliance Policy - PCI (Latest) | High and above are not allowed OWASP Top 10 CWE Top 25 CERT | Any (annually) |
Veracode recommended policies
The following table lists the recommended policies. To learn about the Target VL (Veracode Levels), see About Veracode Levels. After your teams are familiar with these policies, create your own custom policies.
Veracode plans to deprecate these recommended policies. They are named after Veracode business criticality ratings, not finding severity ratings.
| Policy name | Target VL | Flaw severities | Minimum score | Scan requirement | Grace period |
|---|---|---|---|---|---|
| Veracode Recommended Very High | VL5 | No Medium or above | 90 | Static (quarterly) Manual (annually) | 0 |
| Veracode Recommended High | VL4 | No Medium or above | 80 | Static (quarterly) | 0 |
| Veracode Recommended Medium | VL3 | No High or above | 70 | Static (quarterly) | 0 |
| Veracode Recommended Low | VL2 | No Very High (Critical) | 60 | Any (semi-annually) | 0 |
| Veracode Recommended Very Low | VL1 | Any (once) | 0 | ||
| Veracode Recommended Very High + SCA | VL5+SCA | No Medium or above | 90 | Static (quarterly) Manual (annually) | 0 |
| Veracode Recommended High + SCA | VL4+SCA | No Medium or above | 80 | Static (quarterly) | 0 |
| Veracode Recommended Medium + SCA | VL3+SCA | No High or above | 70 | Static (quarterly) | 0 |
| Veracode Recommended Mobile Policy | Static (quarterly) | 0 | |||
| PCI 3.2.1 | No High or above OWASP Top 10 CWE Top 25 CERT | Any (once) | 0 |
Veracode transitional policies
Transitional policies are no longer recommended. They were originally created to establish a baseline Security Quality Score for applications without policies.
Transitional policies don't support grace periods. Without a grace period, the Security Quality Score is effective as soon as the scan results are published.
The following table lists the transitional policies. To learn about the Target VL (Veracode Levels), see About Veracode Levels.
| Policy name | Target VL | Minimum score | Scan requirement | Grace period |
|---|---|---|---|---|
| Veracode Transitional Very High | VL1 | 90 | Any (Once) | 0 |
| Veracode Transitional High | VL1 | 80 | Any (Once) | 0 |
| Veracode Transitional Medium | VL1 | 70 | Any (Once) | 0 |
| Veracode Transitional Low | VL1 | 60 | Any (Once) | 0 |
| Veracode Transitional Very Low | VL1 | 50 | Any (Once) | 0 |
Built-in policy for SCA Agent-based Scan
Depending on when your organization was added to the Veracode Platform, the default policy for SCA agent workspaces is either Veracode Policy - SCA Agent default or Veracode Recommended SCA Very High.
Both are the same. Once your teams are familiar with these policies, create your own custom policies.
The following table lists the rules in these policies.
| Rule type | Requirement | Advanced options |
|---|---|---|
| Findings by Severity | Low and above are not allowed | Not applicable. This rule does not apply to SCA agent-based scans. |
| Vulnerability Severity | Very High (Critical) are not allowed | Vulnerable Methods: Any Dependency: Any Fix Available: Any Build Action: Warning Override Severity: No |
| Vulnerability Severity | High are not allowed | Vulnerable Methods: Any Dependency: Any Fix Available: Any Build Action: Warning Override Severity: No |
| Vulnerability Severity | Medium are not allowed | Vulnerable Methods: Any Dependency: Any Fix Available: Any Build Action: Warning Override Severity: No |
| Vulnerability Severity | Low are not allowed | Vulnerable Methods: Any Dependency: Any Fix Available: Any Build Action: Warning Override Severity: No |
| Component License | High are not allowed | Dependency: Direct Non-OSS Licenses Unrecognized Licenses: Allowed Component with Multiple Licenses: All licenses must meet requirements Build Action: Warning Override Severity: No |
| Component Version | Outdated versions are not allowed | Dependency: Direct Build Action: Warning Override Severity: No |