For Audit Firms (CCSAC)
Your PCI DSS clients already ask for crypto audits. Accredit once and open a recurring revenue line. The Council does not run audits itself — all CCSA audits go through accredited CCSAC partners (the analog of a QSA Company in PCI SSC).
A CCSAC is a legal entity accredited by the Council to perform CCSA audits. Only staff of an accredited CCSAC may deliver audit services under the CCSA brand. Accreditation is annual and is maintained through the QA programme (random sampling of ROCs).
Target audience: existing QSA Companies, ФСТЭК ТЗКИ licensees, smart-contract auditors, forensic firms and mid-tier global firms (phases 2–3). Named firms are listed as prospective candidates.
Requirements: 6 groups
- Active legal entity in the accreditation zone (RF, KZ, BY, UZ, AM — phase 1; BRICS+ — phase 3)
- At least 3 years in IS audit (or 1 year + a strong pedigree)
- No unresolved litigation, bankruptcy procedures or regulator sanctions
- Charter capital of at least $12,000 (for RF)
- 3-year financial statements or equivalent
- Not in liquidation
- Professional Liability (E&O): $1,150,000/incident / $5,600,000 aggregate
- General Commercial Liability: $560,000/incident
- Cyber Liability (recommended): $1,150,000/incident
- Certificate of insurance filed with the Council annually
- May not sell/implement security tools to the same client being audited
- Formal segregation of the audit practice from consulting/integration
- A written Independence Policy
- A 2-year cooling-off period
- At least 2 individual CCSA-QSAs on staff (employees, not contractors)
- At least 1 Lead Auditor (may be added within 12 months)
- A designated Quality Manager
- A Compliance Officer
- An assessment methodology aligned to the CCSA ROC Reporting Template
- A QA programme — peer review of every ROC before delivery to the client
- Document retention of at least 5 years
- Change control when new standard versions are released
- A conflict-of-interest disclosure procedure
- A staff training/qualification programme
Accreditation procedure: 6 stages
Accreditation scope (segment × level)
C.1 — custodial wallets/custodians (HSM expertise required)
C.2 — non-custodial wallets (mobile/desktop security)
C.3 — exchanges (broad expertise)
C.4 — issuers (HSM/MPC for mint/burn keys; smart-contract security and reserve attestation are out of CCSA scope, Section 0.2.2)
Level 1: 2 CCSA-QSA
Level 2: 3+ CCSA-QSA + at least 1 Lead Auditor
Level 3: 5+ CCSA-QSA + 2+ Lead Auditors + at least 10 Level 2 audits done
New-segment extension: $1,500
Level extension (L2 -> L3): $2,500
Cost of accreditation (year 1)
Figures are draft v0.2 and indicative. Insurance ranges and the "RUB 3–5M" total are indicative.
| Item | Initial (year 1) | Annual renewal |
|---|---|---|
Application fee | $3,500 | — |
Annual CCSAC fee | $17,000 | $17,000 |
Pilot audit (if required) | $6,000 | — |
Staff training (CCSA-QSA ×2 min) | $3,500 (delta PCI QSA ×2) up to $6,000 (standard path) | $700/person requalification |
Insurance E&O | RUB 1–3M/yr (indicative) | RUB 1–3M/yr (indicative) |
Year-1 minimum | RUB 3–5M (indicative range) | RUB 3–5M (indicative) |
Reinstatement after suspension: $6,000 + remediation costs.
Sanctions
Systematically low-quality ROCs -> a 90-day remediation plan
Ignoring remediation -> accreditation suspension
Forged ROC / fabricated evidence -> termination + publication
Independence breach -> suspension until resolved
The accreditation zone and named firms (Информзащита, Positive Technologies, BI.ZONE, ДиалогНаука, F.A.C.C.T., HashEx, BDO, Grant Thornton) are listed as prospective candidates, not confirmed partners.
Register interest in CCSAC accreditation
Audit-firm accreditation opens with the v1.0 standard release. Leave a firm contact and the Council will notify you when the first cohort opens and send the CCSAC requirements pack.
The Council responds within 5 business days.
This opens an email in your mail client with the subject prefilled. The Council does not share contacts with third parties.
No contact data is collected on the site — the email opens in your own mail client.
Request CCSAC accreditation
A CCSAC is a legal entity accredited by the Council to perform CCSA audits. Only staff of an accredited CCSAC may deliver audit services under the CCSA brand. Accreditation is annual and is maintained through the QA programme (random sampling of ROCs).