For Auditors (CCSA-QSA)
PCI DSS is a mature market; clients ask for crypto audits you cannot yet deliver. CCSA is the natural extension of the specialty. Three certification tiers, a structure modelled on PCI DSS v4.0.1.
Certification is individual only. You can work as an auditor solely within an accredited audit firm (CCSAC). The standard's structure mirrors PCI DSS v4.0.1 (Defined / Customized Approach, Good Practice, Examples), which lowers the switching cost for experienced QSAs.
A three-tier ascending ladder. An individual without a certificate has access to the standard text only and may not perform audits.
Individual without a certificate — access to the standard text only, no audit rights
Three certification tiers
A three-tier ascending ladder. An individual without a certificate has access to the standard text only and may not perform audits.
Entry tier: participate in audits within a CCSAC team. No ROC/AOC signing rights.
eLearning, ~40h self-study. Exam: 60 questions / 90 minutes, pass 70%, online proctored. Validity 5 years.
Who qualifies: entry gates
At least 1 year in IT-security or compliance
Basic blockchain understanding (Bitcoin, Ethereum)
English at a technical-reading level
Rights
Participate in audits within a CCSAC team
SAQ coaching for Level 1 clients
May not sign a ROC or Attestation of Compliance
Obligations
Annual maintenance to keep registry status
Adherence to the CCSA Code of Professional Responsibility
Fee (indicative)
Indicative values$600 initial; $200/yr maintenance; $400 renewal at year 5
Right to conduct L1/L2 audits within a CCSAC and sign a ROC under a Lead Auditor.
Standard path: eLearning + instructor-led + practice audit, ~120h (6 weeks part-time). Delta-course for active PCI QSAs: 2 weeks full-time (80h). Delta for ГОСТ 57580: 3 weeks (120h). Exam: 100 theory questions (3h) + 1 practical case (4h), 80% theory + Pass practical. Validity 1 year.
Who qualifies: entry gates
Active PCI QSA (priority path)
ISO 27001 Lead Auditor + 2 years in crypto projects
Active ГОСТ 57580 auditor (ФСТЭК licensee) + basic crypto knowledge
5+ years in IT-security + 2+ years in crypto + passed CCSA Practitioner
Documents: proof of base certification, CV, 2 references (one from the current CCSAC employer)
Rights
Conducts Level 1 and Level 2 audits within a CCSAC
Participates in Level 3 audits (cannot solo-sign)
Signs SAQ reviews and Pre-assessment
Signs the ROC under a Lead Auditor
Obligations
Works within exactly one accredited CCSAC (multi-affiliation forbidden)
Conflict-of-interest declaration for every audit
At least 5 audits per year to keep practical qualification
Subscription to CCSA QA review (sampled ROC checks)
Fee (indicative)
Indicative valuesStandard path $3,000; delta PCI QSA $2,000; delta ГОСТ 57580 $2,500; requalification $700/yr
Senior auditor: signs ROC L1/L2/L3, runs the team, peer-reviews in the QA programme.
Instructor-led intensive, 5 days (40h). Exam: a 1-day "judge & jury" with 3 ambiguity cases, scored by a panel of 3 active Lead Auditors. Validity 2 years.
Who qualifies: entry gates
Active CCSA-QSA certificate
At least 10 CCSA audits over 2 years, at least 1 of them Level 3
Clean QA history with no revoked ROC
Recommendation from the Lead QA Council
Rights
Signs ROC at Level 1, 2, 3
Runs the audit team
Decides on Compensating Controls (Level 2)
Acts as a peer reviewer in the Council QA programme
Obligations
Attends the Council Annual Lead Auditor Summit for renewal
Peer-reviews at least 5 colleagues' ROCs per cycle
Fee (indicative)
Indicative values$3,500 initial; $1,500 re-validation every 2 years
Retake fees
Practitioner: $300 (max 2 retakes)
CCSA-QSA: $900 (max 2 retakes); a third attempt requires re-taking the course
Replacement certificate: $100
CCSA Code of Professional Responsibility
Signed by every certified auditor.
Independence. No financial interest in the client; may not have been the client's employee within 2 years.
Objectivity. The ROC is based on observable facts, not on the client's narrative.
Professional competence. Knowledge maintained through requalification.
Confidentiality. Client information is not disclosed without permission.
Professional behavior. No public disparaging statements about clients, competitors or the Council.
Anti-corruption. Gifts from clients are capped at $100; affiliations are disclosed.
Sanctions for violations
| Violation | Sanction |
|---|---|
Conflict of interest without disclosure | 6-month suspension |
Forged ROC | Certificate revocation + reapply ban |
Client data leak | 1-year suspension + civil liability |
Systematically low-quality ROCs | Suspension until remediation training |
Bribery | Revocation + public notice + referral to law enforcement |
Council certification infrastructure
A learning portal (LMS) with courses, video and practical exercises.
A sandbox for practical exams: a test MPC cluster, an HSM simulator, an air-gap test environment, watch-only monitoring infrastructure.
Online proctoring; offline exams quarterly in Moscow, St Petersburg, Almaty.
A public registry of certified Practitioners / CCSA-QSAs / Lead Auditors.
Register interest in auditor certification
The Practitioner / CCSA-QSA / Lead Auditor programmes open with the v1.0 standard release. Tell us your active qualification (PCI QSA, ГОСТ 57580, ISO 27001 LA) and the Council will notify you about the first cohort and the delta-course.
The Council responds within 5 business days.
This opens an email in your mail client with the subject prefilled. The Council does not share contacts with third parties.
No contact data is collected on the site — the email opens in your own mail client.
Become a CCSA-QSA
Certification is individual only. You can work as an auditor solely within an accredited audit firm (CCSAC). The standard's structure mirrors PCI DSS v4.0.1 (Defined / Customized Approach, Good Practice, Examples), which lowers the switching cost for experienced QSAs.
Certification is individual only: working as an auditor requires employment at an accredited CCSAC. The delta-course is the fast-track entry for active PCI DSS QSAs.