v0.2 draft -> v1.0 — release 1 December 2026.
One standard for protecting cryptographic material. One audit. Your existing certificates carried over.
CCSA Standard is a narrow extension of PCI DSS v4.0.1 for protecting Critical Cryptographic Material: private keys, seed phrases, MPC shares, HSM PINs, session tokens. Compatible with PCI DSS, ГОСТ Р 57580, CCSS, SOC 2 and MiCA through open carry-over.
Draft v0.2 -> v1.0. Subject to change before 2027-01-01.
Four audiences — four paths
CCSA addresses four market roles. Pick yours and go straight to the concrete steps.
One standard instead of five audits; existing certificates carried over; a trust mark for banks and insurers.
Get certified ->Become a CCSA-QSA via a two-week delta-course and exam, with no repeat of the base certification.
Become a CCSA-QSA ->Accreditation as a CCSAC — a new certification service on the familiar PCI structure.
Become accredited as a CCSAC ->A measurable, referenceable methodology, an open mapping, and the LVCS registry as a source of trust.
LVCS registry ->v0.2 -> v1.0: what is changing
The standard evolves in the open: version deltas, errata, and requirements under public consultation.
Register interest
The standard is a v0.2 draft. Leave a contact and the Council will reach out when v1.0 is released.
The Council responds within 5 business days.
This opens an email in your mail client with the subject prefilled. The Council does not share contacts with third parties.
No contact data is collected on the site — the email opens in your own mail client.
Reference site4pay.online is the first site to state that it applies CCSA as a reference standard. This signals interest in the standard, not confirmed membership or certification.
Why it is costly and fragmented today
Crypto-infrastructure security in 2026 is fragmented. To enter international markets and earn the trust of banking partners and insurers, an operator must pass PCI DSS, ГОСТ 57580, SOC 2, a commercial security audit and Proof of Reserves at once — each with a separate auditor, methodology and report.
Who standardizes what — and where the gap is
| Segment | Standardizer | Gap |
|---|---|---|
Card payments | PCI SSC (PCI DSS) | Does not cover crypto |
Wallets and exchanges | C4 (CCSS) | Narrow adoption, no enforcement and no accredited-assessor network |
DLT in RU financial institutions | Rosstandart (GOST R 57580.3) | RU only; general IT-security requirements, not custody specifics |
Stablecoins and VASPs in the EU | EBA / ESMA (MiCA) | A regulatory mandate, not a technical standard |
Smart contracts | Private auditors | No common methodology or registry |
One referenceable standard
CCSA references rather than rewrites. A narrow delta only for protecting CCM — 8 domains, just as PCI DSS protects only Cardholder Data.
Existing baselines <-> the CCSA delta on output.
Carry-over to 5 baseline standards: PCI DSS, ГОСТ 57580, CCSS, SOC 2, MiCA.
An open standard — the text is free.
CCSA protects only Critical Cryptographic Material — by analogy with how PCI DSS protects only cardholder data. Deliberately out of scope: smart-contract security, Proof of Reserves, AML and on-chain monitoring, trading-engine integrity. This is a positioning boundary, not a gap.
Critical
An honest frame
First principles
We protect only the data that directly grants access to funds.
Every requirement follows PCI DSS v4.0.1: Defined Approach Requirement, Testing Procedures, Customized Approach Objective, Applicability Notes, Purpose, Good Practice, Examples.
In Place / Not in Place / N/A / CC. No five-point scales or weighted averages.
Valid PCI DSS / ГОСТ / CCSS / SOC 2 / MiCA certificates carry over. About half the audit scope, 1.5–2x lower cost for the client.
The Council does not audit; accredited CCSACs and certified CCSA-QSAs do.
The Council does not provide audit or consulting and does not sell security tools. The model is copied from PCI SSC.
CCSA reduces, but does not eliminate, the risk of compromising cryptographic material. Certification is not a guarantee against an incident. Audit quality is controlled: random ROC sampling, peer review and sanctions up to revocation of accreditation.
CCSA Council is a standard setter, not a guarantor.
Ready to remove duplicate audits?
Pick your path — product certification or auditor certification. Or contact the Council.
The Council responds within 5 business days.