CCSA certification
How certification works: 4 application segments, an 8-domain applicability matrix, 3 levels and a binary assessment methodology.
CCSA does not certify an organization in general; it certifies the protection of cryptographic material within a specific line of business. A subject selects the applicable segments (C.1–C.4), determines which of the 8 overlay-B domains are mandatory, and is audited at one of three levels. The result is published in the LVCS registry.
Certification logic
Four application segments
Section C of the standard. Each segment defines its own set of mandatory domains and the parameter used to pick a level.
Organizations that hold clients' crypto assets under their own private-key management.
Segments in detailLevel-selection parameter
AUM (< $5M / $5M–$500M / > $500M)
Software and devices that give users self-control of their keys. The certification subject is the vendor or manufacturer, not the end user.
Segments in detailLevel-selection parameter
MAU (< 10K / 10K–1M / > 1M)
Trading platforms (CEX, DEX frontends, OTC) with respect to protection of CCM custody infrastructure.
Segments in detailLevel-selection parameter
Daily volume (< $1M / $1M–$100M / > $100M)
Issuers of stablecoins, RWA, fiat-tokens and security tokens with respect to protection of mint/burn keys.
Segments in detailLevel-selection parameter
Market cap (< $5M / $5M–$100M / > $100M)
Applicability matrix (8 domains x 4 segments)
M — mandatory, R — recommended. In v0.2 no domain is non-applicable for any segment.
| B.x | C.1 | C.2 | C.3 | C.4 |
|---|---|---|---|---|
| B.1 | M | M | M | M |
| B.2 | M | M | M | M |
| B.3 | M | M | M | M |
| B.4 | M | M | M | M |
| B.5 | M | M | M | M |
| B.6 | M | R | M | R |
| B.7 | M | R | M | M |
| B.8 | M | M | M | M |
M — Mandatory
R — Recommended
N/A — Not applicable
For C.2, domains B.6 and B.7 are recommended (vendor/device dichotomy). For C.4, domain B.6 is recommended for user-facing wallets, but multi-sig for mint/burn keys is always mandatory (B.6.1).
Three certification levels
L1 Foundation, L2 Standard, L3 Advanced. Full methodology on the Levels page.
L1 — Foundation: In Place >= 90%, CC <= 10%. Startups, MVPs, small volume.
In Place
>= 90%
CC max
<= 10%
Not in Place
0%
L2 — Standard: In Place >= 95%, CC <= 5%. Regulated VASPs, the bulk of participants.
In Place
>= 95%
CC max
<= 5%
Not in Place
0%
L3 — Advanced: In Place 100% (or <= 2.5% CC with Council approval), CC <= 2.5%. Systemically important infrastructure.
In Place
>= 100%
CC max
<= 2.5%
Not in Place
0%
At every level, Not in Place = 0% among mandatory requirements and all 8 Critical Requirements are In Place via the Defined Approach.
Level availability by segment (4 x 3)
Which segment x level combinations are used in practice. All 12 are formally available, but some have limited applicability.
| Segment | L1 | L2 | L3 |
|---|---|---|---|
C.1 | Pilots | Mainstream | Systemic players |
C.2 | Mainstream | Required by audit firms | Optional, rare |
C.3 | Startups, pilot only | Mainstream | Top exchanges |
C.4 | Small issuers < $5M cap | Mid-cap | Systemic stablecoins |
Binary methodology
Each applicable requirement gets one of five statuses: In Place, In Place (Customized), Not in Place, Not Applicable, Compensating Control. There are no numeric scales or intermediate statuses: any gap means Not in Place. See the Levels page for details.
8 Critical Requirements
Eight requirements are flagged as Critical: the Customized Approach is not allowed, carry-over does not apply, and Not in Place in any of them means automatic fail regardless of the overall In Place ratio. For four (B.1.1, B.1.2, B.5.2, B.7.3) compensating controls are fully forbidden; for the other four (B.2.1, B.3.1, B.4.1, B.8.1) they are allowed only at L1 with Council approval.
If an organization operates in several segments, the mandatory requirements of all applicable segments apply (their union). Shared infrastructure is tested once, a single ROC is issued split by segment, and the overall level equals the maximum of the per-segment levels. Carry-over applies per requirement, not per segment.
Certification logic
CCSA does not certify an organization in general; it certifies the protection of cryptographic material within a specific line of business. A subject selects the applicable segments (C.1–C.4), determines which of the 8 overlay-B domains are mandatory, and is audited at one of three levels. The result is published in the LVCS registry.