To develop, adopt, and advocate standards for web application security.

The Web Application Security Consortium (WASC) is an international group of experts, industry practitioners, and organizational representatives who produce open source and widely agreed upon best-practice security standards for the World Wide Web.

As an active community, Web Application Security Consortium (WASC) facilitates the exchange of ideas and organizes industry Projects. WASC consistently releases technical information, contributed articles, security guidelines, and other useful documentation. Businesses, educational institutions, governments, application developers, security professionals, and software vendors all over the world utilize our materials to assist with the challenges presented by web application security.

• Create an open forum for the creation, discussion, and dissemination of knowledge pertaining to web application security.
• Educate the market regarding web application security related matters.
• Create a vendor neutral champion/voice of the web application security industry.

• WASC does not advocate vendor specific technologies, services, or solutions.
• WASC does not speak on any one person or company's behalf, but rather on the industry's behalf as an agnostic champion of web application security related matters.

The Board of Directors is a five-person group of Officers responsible for the management and oversight of the consortium's business affairs in accordance with the Charter. The Board provides oversight for Projects to ensure timely completion and alignment with consortium goals. The Board of Directors is also responsible for management of corporate assets, allocating resources, and facilitating the organization’s broad objectives.

Selection Process

The five people on the Board of Directors are elected by the Officers every six months during the first full week of May and December. During the two weeks prior to the next Board of Directors vote, any non-emeritus status Officer of WASC who participated in the previous Board of Directors vote may submit himself or herself as a candidate for consideration of a Board of Directors seat.

When the list of candidates are announced, each Officer may vote for five of the listed candidates. Immediately following the close of the vote, the five candidates with the most votes are considered the new Board of Directors.

To minimize any conflict of interest, no more than one Officer employed by the same organization may be a candidate for or occupy the Board of Directors at the same time. If multiple Officers from the same organization submit there candidacy for the Board of Directors, the senior Officer, meaning the one with the earlier date of being elected an Officer, shall be given priority.

Responsibilities

The Board is responsible for carrying out the following activities:

• Review the status of Projects that are in-progress.
• Review new Project proposals.
• Govern the vote for Project proposal acceptance.
• Govern the vote for Project deliverable acceptance.
• Govern the vote for nominated Officers (Subject to Voting Limitations).
• Govern the semi-annual Board of Directors election process.
• Review Officer and Member requirement obligations.
• Process Officer nominated amendments to the Charter. Charter amendments require an affirmative vote of two-thirds of the eligible votes (Subject to Voting Limitations).

Rights

Board of Director meetings require a quorum of at least three members present. All decisons and resolutions must be approved by a majority of the votes cast. The Board of Directors may enact the following resolutions:

• Establish or dismiss commitees responsible for overseeing specific WASC activities and initiatives.
• Establish or dismiss personnel positions in WASC responsible for carrying out specific job duties.
• Appoint volunteers to serve as committee leaders in an established WASC committee.
• Appoint volunteers to serve in established personnel position.

Bi-Monthly Meetings

Selection Process

The Officer selection process is governed by the Board of Directors and is approved by a majority vote of the current Officers. All candidates must be nominated by an existing Officer and must have been a Member for a minimum of four months. Officers submit candidates for consideration in writing prior to the periodic Board of Directors meeting. Officer candidates must outline their qualification as part of the review and voting process. An Officer vote will be held to accept or deny the candidate as an Officer of WASC. Candidates may only submit themselves for consideration once every four months.

Upon acceptance, new Officers must show consortium participation by the next Board of Directors meeting. Failure to meet the requirements may be grounds for Officer conversion to emeritus status.

* There is a twenty person limit on the total number of non-emeritus Officers.

Rights

Subject to the appropriate charter process, an Officer may:

• Participate in the semi-annual voting process to elect the Board of Directors.
• Submit himself or herself as a candidate for consideration of a Board of Directors seat during the next election cycle. Provided they have participated in the previous Board of Directors or Charter amendment vote.
• Vote on new Officer candidates.
• Invite individuals for membership and nominate members for Officer positions.
• Submit new Project proposals for consideration by the Board of Directors.
• Vote on Project proposals and final Project deliverables.
• Propose and vote on amendments to the Charter during the semi-annual board election cycle.

Responsibilities

• Participation in WASC Projects - Officer must participate in at least one Project at any given time. (periods of WASC Project inactivity excluded)
• Direct or indirect involvement in the Web Application Security industry.
• Support the adoption of WASC Projects in vendor products and industry standards.

Emeritus Status

An Officer may be converted to Emeritus status in the following ways:

• Voluntary conversion of Officer to Emeritus status through written notification by the Officer to the Board of Directors.
• Involuntary conversion of Officer to Emeritus status through a vote of two-thirds of the eligible Officers.

An Officer may be reinstated from Emeritus status by:

• Written request to the Board of Directors and an affirmative vote of two-thirds of the eligible Officers.

Committees are small groups of three to seven Members commissioned to oversee and carry out specific WASC business issues. Each Committee is responsible for developing their own agenda and operating procedures. Under the oversight of ths Committee Leader, Committees are granted decision-making authority for the content and direction of their group.

Committees are established by the Board of Directors and directed by a Board of Directors appointed Committee Leader.

Committee Leader

Committee Leaders must report Committee activity and progress prior to each Board of Directors meeting.Committee Member

WASC has two types of members - Individual Members and Organizational Members. Individual Members are those not affiliated with any organization but rather participate on their own behalf. Organizational Members are organizations (corporate, government, academic, etc...) who support WASC activities.

Members who are employed by companies that have direct involvement in web application security are urged to become Organizational Members.

Registration Process

Any individual or organization is able to register with WASC free of charge.

• Register on the WASC website with their real name, organization, and valid contact information.
• WASC will verify submitted information.
• Notification will be sent upon acceptance.

Member Benefits

• A member listing on the WASC website including the name of the member, title, organization, logo, and member-since date.
• Ability to display a WASC Member logo on a personal or organization website.
• Ability to participate in WASC Projects.

Selection Process

The acceptance of a Project proposals is subject to the following process:

Project Process

1. Project Proposal Submission
• An Officer, prior to the next Board of Directors meeting, submits a formal project proposal.
2. Board of Directors Project Nomination Review
• Board of Directors reviews the Project plan for qualified Project Leader, scope of work, required activities, final deliverables, time frame, etc...
• Board of Directors reviews the plan for direction, completeness, and thoroughness.
• Board of Directors announces the Project proposal to the Officers or asks the submitting Officer for additional clarification.
3. New Project Vote
• A vote of the Officers is held to accept or deny the Project proposal. Acceptance requires a majority vote.
4. New Project Announcement
• Upon acceptance of the Project proposal an announcement is made to all Officers.
• A public announcement is made.
5. Project Work
• Project Leader creates the Project team.
• Project team works to complete Project plan.
• The Project Leader submits periodic progress updates to the Board of Directors.
6. Completion of Work
• Upon completion, Project Leader submits deliverable to Board of Directors for review.
• Board of Directors accepts deliverable or requests continued work/clarification by Project Leader.
• An Officer majority vote is held to accept or deny the Project deliverables.
7. Project Deliverable Announcement
• Upon acceptance of the Project deliverable announcement made to all Officers.
• Public announcement.

Project Leaders

Process

1. The Board of Directors receives a proposal or scheduled voting initiative.
2. The Board of Directors is allowed 1-2 weeks to review proposals and additional time if further consideration is required.
3. Officers are given one week prior notification of an impending vote.
4. A standard format email voting ballot is sent to the Officers’ mailing list.
5. Officers have one week to openly cast their votes to the mailing list.
6. The Board of Directors tallies the casted ballots and submits the final outcome to the Officers’ mailing list.

Voting Limitations

In order to limit the influence of any particular group in the consortium certain limitations are placed on Officers during certain voting processes:

• Officers may nominate co-workers from the same employer, but Officers from the same employer may not particpate in the voting process.
• Only one Officer from the same organization may participate in the Charter ammendment voting process. The senior Officer, meaning the one with the earlier date of being elected an Officer, shall be given the right to vote.