I have an software application that I need to "review against" a set of security guidelines. This seems clear to me, but a colleague questioned this usage.
One alternative would be to review the application "per" the guidelines.
Are there other alternatives? What is the best way to convey this action?