Changelog
What's in v0.2, errata, and the requirements open for public consultation on the way to v1.0.
This is the page the "Draft v0.2 -> v1.0" badge points to: it shows what changed and what is still under consultation.
Version history
From the current v0.2 draft to the v1.0 release target and the first minor patch. The v1.0 and v1.0.1 dates are planning targets, not guarantees.
v0.2
2026-05 (current draft)
v1.0
2026-12-01 (target)
v1.0.1
Q2 2027 (target)
v0.2
Current draft2026-05 (current draft)
First public draft in PCI DSS format: binary assessment methodology, Customized Approach, an explicit list of Critical Requirements, expanded ROC and SAQ templates.
Changes in this version
- Changed
Dropped the 0.0–1.0 numeric scale; moved to a binary assessment: In Place / Not in Place / N/A / Compensating Control.
- Added
Introduced the Customized Approach, modelled on PCI DSS v4.0, as an alternative compliance path (except for Critical Requirements).
- Changed
Rewrote every B.1–B.8 requirement as Defined Approach Testing Procedures with Examine / Interview / Observe / Trace steps.
- Added
Added inline Applicability Notes / Purpose / Good Practice / Examples blocks to every requirement.
- Changed
Annual full audit for all levels; the two-year cycle for Level 1 was removed.
- ClarifiedC.2
Segment C.2 reframed around the software-vendor-scope / device-scope dichotomy.
- ChangedB.7.3
Tightened the watch-only monitoring SLA (B.7.3) for Level 1.
- ChangedB.8.5
Geographic distribution of personnel (B.8.5) became Mandatory for Level 2 and above.
- RemovedB.2
PCI DSS Req 3.6.1 mapping moved to Not Applicable: CCSA is stricter than the baseline on entropy.
- AddedD.2.5
The 8 Critical Requirements are now defined explicitly (Section D.2.5), split into fully-forbidden CC and restricted CC.
- ChangedA3
The ROC template (Annex 3) was substantially expanded with a detailed Requirement Assessment Worksheet and carry-over validation matrix.
- AddedA4
SAQ-C1 (Annex 4) gained a complete reference question library.
v1.0
Planned2026-12-01 (target)
Release target. Incorporates the outcome of public consultation; the normative text is frozen. Effective date 2027-01-01.
Changes in this version
- Changed
Incorporated the outcome of public consultation on the open requirements (below).
- Changed
The normative text is frozen; further changes only via backward-compatible minor versions.
- AddedA2.3
Post-quantum cryptography (PQC) included in advisory mode; mandatory for Level 3 only from v2.0 (2029).
v1.0.1
PlannedQ2 2027 (target)
First minor patch from Founding-cohort early feedback; backward compatible, with an errata register maintained.
Changes in this version
- Clarified
Wording clarifications from Founding-cohort early feedback, without changing the meaning of any requirement.
- Errata
Opened a public errata register: confirmed typos and ambiguities are logged and corrected between releases.
Requirements under public consultation
Open questions the Council is collecting comment on before they are frozen in the stated target version. These are open questions, not adopted requirements — wording may change.
| Requirement | Open question | Target version | Comment |
|---|---|---|---|
| B.3.1 | On what terms a mobile-class Secure Enclave is acceptable for CCM storage alongside HSM / MPC in segment C.2 (B.3.1), and where the line sits for Level 2. | v1.0 | Comment on this requirement |
| 0.8.3 | Whether to keep the full Compensating Control ban for restricted-CC requirements (B.2.1, B.3.1, B.4.1, B.8.1) at Level 2 and Level 3, or allow narrow exceptions with Council approval. | v1.0 | Comment on this requirement |
| A2.3 | The exact timing and scope of mandatory post-quantum cryptography for Level 3: confirm the v2.0 window (2029) and the length of the overlap period for legacy schemes. | v2.0 | Comment on this requirement |
| B.1.2 | Whether to require CME segmentation under a dual-stack approach (GOST CSP and international algorithms in parallel), or accept a single CME with the decision recorded in the ROC (B.1.2). | v1.0 | Comment on this requirement |
| B.8.5 | Confirm the geographic-distribution threshold for keyholders at Level 2: the minimum number of jurisdictions and whether distribution within a single country is acceptable (B.8.5). | v1.0 | Comment on this requirement |
| 0.14.2 | Whether to fix the recommended sample sizes (Section 0.14.2) as normative minimums or keep them as informational guidance for the Lead Auditor. | v1.0 | Comment on this requirement |
| 0.2.3 | How the "voluntary jurisdiction" flag is applied in the LVCS registry for entities outside the mandatory-application list (Section 0.2.3). | v1.1 | Comment on this requirement |
Errata
There are no confirmed errata for v0.2 yet. Typos, contradictions and ambiguities in the normative text will be published here with the requirement, a description and the correction. To report a possible error, use the "Comment" link next to a requirement.
CCSA Standard v0.2 (PDF)
The canonical draft text for circulation and audit. Version and checksum are shown on the card.
v0.2
750 KB
SHA-256
9447926060b2…Follow the v1.0 release
Want to be notified when v1.0 ships and the open requirements are resolved? Leave a contact and the Council will reach out.
The Council responds within 5 business days.
This opens an email in your mail client with the subject prefilled. The Council does not share contacts with third parties.
No contact data is collected on the site — the email opens in your own mail client.
Version history
From the current v0.2 draft to the v1.0 release target and the first minor patch. The v1.0 and v1.0.1 dates are planning targets, not guarantees.