Security issues with Web sewices have slowed their adoption for deployment of critical services in the enterprise. Maintaining security in Web sewice architectures is especially difficult because of their open, standards based inte.Jbces. Yet many organizations are moving to this technology and are faced with the challenge of certzfjiing their environments as secure. Unique challenges exist with the combination of Web service authenticalion, network security vulnerabilities, incompatible security mechanisms, open publication of interface definitions, and automated discovely of services. Certification processes mandale the need jbr a security certification boundary given identiJed vulnerabilities. In this paper, we review Web sewice security vulnerabilities and outline guidelines to form an enclave The expressed guidelines are specific to certifjiing a sewice-oriented architecture implemented with Web services.