{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "feed": "CCSA Standard changelog",
  "url": "/changelog",
  "generated": "2026-06-10",
  "note": "Machine-readable mirror of the CCSA standard changelog. Draft v0.2 -> v1.0. Dates and states for v1.0/v1.0.1 are planning targets, not guarantees. RU is primary; en falls back to ru.",
  "versions": [
    {
      "version": "v0.2",
      "date": "2026-05",
      "state": "current",
      "summary": {
        "ru": "Первый публичный черновик в формате PCI DSS: бинарная методология оценки, Customized Approach, явный перечень Critical Requirements, расширенные шаблоны ROC и SAQ.",
        "en": "First public draft in PCI DSS format: binary assessment methodology, Customized Approach, an explicit list of Critical Requirements, expanded ROC and SAQ templates."
      },
      "changes": [
        { "id": "binary-scoring", "kind": "changed", "summary": { "ru": "Отказ от числовой шкалы 0,0–1,0; переход на бинарную оценку In Place / Not in Place / N/A / Compensating Control.", "en": "Dropped the 0.0–1.0 numeric scale; moved to a binary assessment: In Place / Not in Place / N/A / Compensating Control." } },
        { "id": "customized-approach", "kind": "added", "summary": { "ru": "Введён Customized Approach по образцу PCI DSS v4.0 как альтернативный путь соответствия (кроме Critical Requirements).", "en": "Introduced the Customized Approach, modelled on PCI DSS v4.0, as an alternative compliance path (except for Critical Requirements)." } },
        { "id": "testing-procedures", "kind": "changed", "summary": { "ru": "Все требования B.1–B.8 переписаны в формате Defined Approach Testing Procedures с шагами Examine / Interview / Observe / Trace.", "en": "Rewrote every B.1–B.8 requirement as Defined Approach Testing Procedures with Examine / Interview / Observe / Trace steps." } },
        { "id": "pci-format", "kind": "added", "summary": { "ru": "Для каждого требования добавлены inline-блоки Applicability Notes / Purpose / Good Practice / Examples.", "en": "Added inline Applicability Notes / Purpose / Good Practice / Examples blocks to every requirement." } },
        { "id": "annual-reassessment", "kind": "changed", "summary": { "ru": "Ежегодный полный аудит для всех уровней; для Level 1 отменён двухлетний цикл.", "en": "Annual full audit for all levels; the two-year cycle for Level 1 was removed." } },
        { "id": "c2-scope", "kind": "clarified", "ref": "C.2", "summary": { "ru": "Сегмент C.2 переформулирован под дихотомию software vendor scope / device scope.", "en": "Segment C.2 reframed around the software-vendor-scope / device-scope dichotomy." } },
        { "id": "b73-sla", "kind": "changed", "ref": "B.7.3", "summary": { "ru": "Ужесточены SLA watch-only мониторинга (B.7.3) для Level 1.", "en": "Tightened the watch-only monitoring SLA (B.7.3) for Level 1." } },
        { "id": "b85-geo", "kind": "changed", "ref": "B.8.5", "summary": { "ru": "Географическое распределение персонала (B.8.5) стало Mandatory для Level 2 и выше.", "en": "Geographic distribution of personnel (B.8.5) became Mandatory for Level 2 and above." } },
        { "id": "pci-req361", "kind": "removed", "ref": "B.2", "summary": { "ru": "Маппинг PCI DSS Req 3.6.1 переведён в Not Applicable: CCSA строже baseline в части энтропии.", "en": "PCI DSS Req 3.6.1 mapping moved to Not Applicable: CCSA is stricter than the baseline on entropy." } },
        { "id": "critical-explicit", "kind": "added", "ref": "D.2.5", "summary": { "ru": "Перечень из 8 Critical Requirements определён явно (Section D.2.5), с разделением на fully-forbidden CC и restricted CC.", "en": "The 8 Critical Requirements are now defined explicitly (Section D.2.5), split into fully-forbidden CC and restricted CC." } },
        { "id": "roc-worksheet", "kind": "changed", "ref": "A3", "summary": { "ru": "Шаблон ROC (Annex 3) существенно расширен detailed Requirement Assessment Worksheet и carry-over validation matrix.", "en": "The ROC template (Annex 3) was substantially expanded with a detailed Requirement Assessment Worksheet and carry-over validation matrix." } },
        { "id": "saq-library", "kind": "added", "ref": "A4", "summary": { "ru": "SAQ-C1 (Annex 4) дополнен полной reference-библиотекой вопросов.", "en": "SAQ-C1 (Annex 4) gained a complete reference question library." } }
      ]
    },
    {
      "version": "v1.0",
      "date": "2026-12-01",
      "state": "planned",
      "summary": {
        "ru": "Целевой релиз. Учитывает итоги публичного обсуждения; нормативный текст фиксируется. Вступление в силу — 2027-01-01.",
        "en": "Release target. Incorporates the outcome of public consultation; the normative text is frozen. Effective date 2027-01-01."
      },
      "changes": [
        { "id": "public-consultation", "kind": "changed", "summary": { "ru": "Учтены результаты публичного обсуждения открытых требований (см. ниже).", "en": "Incorporated the outcome of public consultation on the open requirements (below)." } },
        { "id": "normative-freeze", "kind": "changed", "summary": { "ru": "Нормативный текст фиксируется; дальнейшие изменения — только через minor-версии с обратной совместимостью.", "en": "The normative text is frozen; further changes only via backward-compatible minor versions." } },
        { "id": "pqc-advisory", "kind": "added", "ref": "A2.3", "summary": { "ru": "Постквантовая криптография (PQC) включена в advisory-режиме; обязательна для Level 3 только с v2.0 (2029).", "en": "Post-quantum cryptography (PQC) included in advisory mode; mandatory for Level 3 only from v2.0 (2029)." } }
      ]
    },
    {
      "version": "v1.0.1",
      "date": "2027-Q2",
      "state": "planned",
      "summary": {
        "ru": "Первый minor-патч по early feedback Founding-когорты; обратная совместимость, ведётся реестр errata.",
        "en": "First minor patch from Founding-cohort early feedback; backward compatible, with an errata register maintained."
      },
      "changes": [
        { "id": "early-feedback", "kind": "clarified", "summary": { "ru": "Уточнения формулировок по early feedback Founding-когорты без изменения смысла требований.", "en": "Wording clarifications from Founding-cohort early feedback, without changing the meaning of any requirement." } },
        { "id": "errata-track", "kind": "errata", "summary": { "ru": "Открыт публичный реестр errata: подтверждённые опечатки и неоднозначности фиксируются и исправляются между релизами.", "en": "Opened a public errata register: confirmed typos and ambiguities are logged and corrected between releases." } }
      ]
    }
  ],
  "openDecisions": [
    { "id": "b31-secure-enclave", "ref": "B.3.1", "targetVersion": "v1.0" },
    { "id": "restricted-cc-l2", "ref": "0.8.3", "targetVersion": "v1.0" },
    { "id": "pqc-enforcement", "ref": "A2.3", "targetVersion": "v2.0" },
    { "id": "dual-stack-cme", "ref": "B.1.2", "targetVersion": "v1.0" },
    { "id": "b85-geo-l2", "ref": "B.8.5", "targetVersion": "v1.0" },
    { "id": "sampling-sizes", "ref": "0.14.2", "targetVersion": "v1.0" },
    { "id": "voluntary-jurisdiction", "ref": "0.2.3", "targetVersion": "v1.1" }
  ]
}