About the Council
An industry standards organization for crypto-infrastructure security. It owns the standard and the IP; audit and consulting sit in an external partner network.
What the CCSA Council is
The CCSA Council (Crypto Custody & Security Assurance Council) is an industry standards organization for crypto-infrastructure security. Its legal form is a limited company (RF); it owns the standard and the intellectual property. Audit and consulting are placed in an external partner network.
Draft v0.2 -> v1.0. Subject to change before 2027-01-01.
What the Council owns
What the Council does
- 01
The CCSA standard (copyright).
- 02
The CCSA, CCSA-QSA, CCSAC, LVCS and CCSA Listed Logo trademarks.
- 03
The registries: Participating Organizations, CCSAC, CCSA-QSA, LVCS.
- 04
Training and examination programs.
- 01
Writes and maintains the standard.
- 02
Certifies individual auditors (CCSA-QSA).
- 03
Accredits audit firms (CCSAC).
- 04
Certifies products and platforms (LVCS).
- 05
Runs training and exams.
- 06
Assures quality (QA Program: random ROC sampling — Level 2 a 10% sample, Level 3 100%).
- 07
Maintains the membership registry and resolves disputes.
What the Council does not do — the no-conflict promise
It does not audit clients.
It does not consult on audit preparation.
It does not build commercial security tools.
To remove the duplication of compliance audits for crypto businesses through a standard that references rather than rewrites existing baselines, adding only crypto-specific requirements. To make crypto-infrastructure security predictable and measurable for clients, regulators, insurers and investors.
The CCSA Council is a standard setter, not a guarantor. A private standards organization, not a state regulator.
Vision 2030
By the end of 2030 — targets, not current state.
Bank of Russia recognition: CCSA certification counts toward compliance with Bank of Russia regulations for digital-currency market participants.
At least one RF insurer issues crypto-insurance that requires CCSA certification.
Mission
To remove the duplication of compliance audits for crypto businesses through a standard that references rather than rewrites existing baselines, adding only crypto-specific requirements. To make crypto-infrastructure security predictable and measurable for clients, regulators, insurers and investors.
Seven operating principles
A valid PCI DSS certificate carries over the corresponding CCSA domains via mapping. We complement, not replace.
The Council earns from membership and the certification of auditors and products, not from auditing. The PCI SSC model.
The CCSA <-> PCI DSS / ГОСТ / CCSS / MiCA matrix is published openly and updated with every version. No “closed methodology”.
A two-week delta-course and exam, with no repeat of the base certification.
Participating Organizations see drafts before publication and submit comments; the board includes representatives of all 4 segments.
Functional requirements, not specific products. HSM, MPC and multisig are treated neutrally.
CCSA fits under regulation (ЦБ/ФСТЭК in RF, АРРФР in Kazakhstan), not above it. The goal is to become a recognized assessment methodology.
Values
Every requirement is measurable. If a requirement cannot be tested, it is not in the standard.
The Council cites PCI SSC and C4 as sources, not claiming to reinvent the wheel.
The standard is open; the text downloads free from the site. Membership and certification are paid.
The standard updates on a 3-year cycle, like PCI DSS. No “revolutions” every year.
Bought certificates, rubber-stamp ROCs and copy-paste audits mean immediate revocation of accreditation.
What we do not do
- 01
We do not claim a regulator’s role — enforcement belongs to the state and to market contracts.
- 02
We do not compete with PCI SSC — we complement it for the crypto segment.
- 03
We do not create a “Russian standard” — the base jurisdiction is RF, the content is global.
- 04
We do not sell “closed consulting” on the standard — the text is public; membership, certification and training are paid.
- 05
We do not sell “indulgences” — an attempt to buy a certificate means banning the client, the auditor and the CCSAC.
Trust statements
CCSA reduces, but does not eliminate, the risk of compromising cryptographic material. Certification is not a guarantee against an incident.
The CCSA Council is a standard setter, not a guarantor. A private standards organization, not a state regulator.
First reference site
At the v0.2 draft stage the only nameable party is the founding sponsor; the remaining governance participants are disclosed as appointments are made.
4pay.online is the Council's founding sponsor and the first reference implementation of the CCSA standard. The requirements are validated on live crypto-infrastructure ahead of the v1.0 release.
The Council does not audit 4pay.online and does not consult it on preparation. Certification of 4pay products runs through an independent accredited CCSAC; on decisions touching 4pay, the founder directors recuse.
What the CCSA Council is
To remove the duplication of compliance audits for crypto businesses through a standard that references rather than rewrites existing baselines, adding only crypto-specific requirements. To make crypto-infrastructure security predictable and measurable for clients, regulators, insurers and investors.