About Veracode built-in policies

Veracode provides built-in policies to help organizations begin evaluating their applications against security standards. There are two sets of built-in policies for Static Analysis and Dynamic Analysis scans, and one built-in policy for SCA agent-based scans.

You can set a built-in policy as the default policy in your policy settings, or you can create custom policies.

Veracode transitional policies

Transitional policies run an initial scan to establish a baseline Security Quality Score for the application. As your teams address findings, the score improves. We recommend using these policies when first adopting Veracode for application security testing.

note

Transitional policies don't support grace periods. Without a grace period, the Security Quality Score is effective as soon as the scan results are published.

The following table lists the transitional policies.

Policy name	Target VL	Minimum score	Scan requirement	Grace period
Veracode Transitional Very High	VL1	90	Any (Once)	0
Veracode Transitional High	VL1	80	Any (Once)	0
Veracode Transitional Medium	VL1	70	Any (Once)	0
Veracode Transitional Low	VL1	60	Any (Once)	0
Veracode Transitional Very Low	VL1	50	Any (Once)	0

Veracode recommended policies

Recommended policies assess your applications based on the Veracode Levels. After your teams become familiar with the transitional policies, consider switching to the recommended policies or creating your own custom policies. Veracode applies these recommended policies by default to new application profiles based on the business criticality of the application.

The following table lists the recommended policies.

Policy name	Target VL	Flaw severities	Minimum score	Scan requirement	Grace period
Veracode Recommended Very High	VL5	No Medium or above	90	Static (quarterly) Manual (annually)	0
Veracode Recommended High	VL4	No Medium or above	80	Static (quarterly)	0
Veracode Recommended Medium	VL3	No High or above	70	Static (quarterly)	0
Veracode Recommended Low	VL2	No Very High or above	60	Any (semi-annually)	0
Veracode Recommended Very Low	VL1			Any (once)	0
Veracode Recommended Mobile Policy				Static (quarterly)	0

Built-in policy for SCA agent-based scans

By default, Veracode applies the Veracode Recommended SCA Very High policy to SCA agent-based workspaces.

The following table lists the rules in this policy:

Rule type	Requirement	Advanced options
Findings by Severity	Low and above are not allowed	Not applicable. This rule does not apply to agent-based scans.
Vulnerability Severity	Very High are not allowed	Vulnerable Methods: Any Dependency: Any Build Action: Warning Override Severity: No
Vulnerability Severity	High are not allowed	Vulnerable Methods: Any Dependency: Any Build Action: Warning Override Severity: No
Vulnerability Severity	Medium are not allowed	Vulnerable Methods: Any Dependency: Any Build Action: Warning Override Severity: No
Vulnerability Severity	Low are not allowed	Vulnerable Methods: Any Dependency: Any Build Action: Warning Override Severity: No
Component License	High	Dependency: Direct Build Action: Warning Override Severity: No Non-OSS Licenses Unrecognized Licenses: Allowed Component with Multiple Licenses: All licenses must meet requirements
Component Version	Outdated	Dependency: Direct Build Action: Warning Override Severity: No