Four years ago, the state of Pennsylvania had almost no capability for finding or reporting security vulnerabilities in its software applications, including the many public-facing Web sites through which the state gathers and distributes information to its constituents. However, after several noteworthy attacks and data breaches in its IT systems, including SQL injection campaigns emanating out of China, the state was forced to report a total of 500,000 stolen citizen and employee records during 2007. As the number of these attacks increased, the state's Office of Administration, Office for Information Technology (OA/OIT) realized that there was a need to change its overall security strategy from a network centric based model to a holistic model which included application security. This process was dubbed the Commonwealth Application Certification and Accreditation (CA)2 Process. Today, enforced as a certified mandate affecting all state agencies in Pennsylvania, the (CA)2 set of policies requires all affected organizations to complete a risk assessment process which includes questionnaires, source code scans, host based intrusion scans, and vulnerability assessments before applications are allowed to move into production. These questionnaires, scans, and assessments not only force an established level of application security to be embraced by individual agencies, but also help to benchmark the risk that applications pose to the state's broader IT infrastructure. To date the (CA)2 process has identified critical vulnerabilities that if not corrected could have been exploited by SQL or XSS attacks which could have led to identity thefts and the propagation of malicious code. By closing vulnerabilities before they were exploited, the Commonwealth has prevented data leakage, identity theft and theft of services, and saved millions of dollars that would have been spent on related response efforts. To note, Pennsylvania dropped its total volume of exposed records to just over 200 records during 2008 In 2009, the state had only had a handful of sensitive records compromised, as a direct result of the program. In this talk, former Pennsylvania CISO Bob Maley, the originator and architect of the (CA)2 process, will touch upon everything from the problems that the requirements seek to address to the unique challenge of creating a new security standard, evolving it over time and evangelizing the process to affected constituents.