ROC worksheet — requirement assessment
The reference structure of the Report on Compliance (Annex 3 §A3.7). The report has 15 main sections; each requirement gets an assessment worksheet.
The ROC is an auditor document. Below are the fields of the Requirement Assessment Worksheet, repeated for each B.X.Y requirement, plus the carry-over validation worksheet (§A3.6). On the site this is a reference template; copy-ready Word/PDF/Markdown versions are distributed by the Council.
Tools are the interactive layer of the standard: the self-assessment, checklists and worksheets you fill in on the site. They help you prepare for an audit, surface gaps early, and see which controls are already covered. A self-assessment is not a certification: a full audit is performed annually for all levels (Section D.4.1).
ROC worksheet — requirement assessment
The reference structure of the Report on Compliance (Annex 3 §A3.7). The report has 15 main sections; each requirement gets an assessment worksheet.
| # | Section |
|---|---|
| 1 | Executive Summary |
| 2 | Description of Assessed Entity |
| 3 | Scope of Assessment |
| 4 | Methodology |
| 5 | Baseline Carry-Over (Section A) |
| 6 | Findings by Domain (Section B) 6BB.X.Y |
| 7 | Segment-Specific Findings (Section C) |
| 8 | Compensating Controls |
| 9 | Customized Approach Documentation |
| 10 | Compliance Summary & Level Determination |
| 11 | Corrective Actions & Recommendations |
| 12 | Limitations of Assessment |
| 13 | Sign-off |
| 14 | Confidentiality, Retention & Archival |
| 15 | Appendices |
The ROC is an auditor document. Below are the fields of the Requirement Assessment Worksheet, repeated for each B.X.Y requirement, plus the carry-over validation worksheet (§A3.6). On the site this is a reference template; copy-ready Word/PDF/Markdown versions are distributed by the Council.
ROC worksheet
The Report on Compliance structure: a per-requirement assessment worksheet, Defined-Approach testing procedures, and carry-over validation. Reference template from Annex 3.
Status: In Place / In Place (Customized) / Not in Place / N/A / Compensating Control
Defined-Approach testing procedures: Examine / Interview / Observe / Trace
Evidence references and artefact identifiers
Sample sizes (per the §0.14.2 table)
Findings and observations
Carry-over validation: baseline certification, requirement reference, carry-over status (§A3.6)
Defined-Approach testing procedures: Examine / Interview / Observe / Trace
Status: In Place / In Place (Customized) / Not in Place / N/A / Compensating Control
Carry-over validation: baseline certification, requirement reference, carry-over status (§A3.6)
Carry-over validation: baseline certification, requirement reference, carry-over status (§A3.6)
The eight Critical Requirements undergo full Defined-Approach testing regardless of baseline certifications — carry-over never applies to them.
Per-domain control lists B.1–B.8
One list per domain. Critical Requirements are marked with a star ★ — any “Not in Place” against them is an automatic fail at any level.
Identification and classification of all CCM by categories A–F (a complete, living inventory).
Entropy source qualified and verifiable (TRNG/DRBG/HSM/Secure Enclave/СКЗИ).
Storage mechanism per CCM category (HSM / MPC / Secure Enclave) matches the level.
Hardware-backed signing: the private key never leaves its trusted boundary.
Rotation cadence for all categories; triggered rotation on offboarding within SLA.
Multi-sig thresholds by balance/context; for issuers, mandatory mint-key multi-sig.
Comprehensive logging of CCM events with the required fields.
Background check of CCM personnel with the required elements and periodicity.
ROC worksheet
The ROC is an auditor document. Below are the fields of the Requirement Assessment Worksheet, repeated for each B.X.Y requirement, plus the carry-over validation worksheet (§A3.6). On the site this is a reference template; copy-ready Word/PDF/Markdown versions are distributed by the Council.
ROC worksheet — requirement assessment
The reference structure of the Report on Compliance (Annex 3 §A3.7). The report has 15 main sections; each requirement gets an assessment worksheet.
v0.2 draft -> v1.0
Coming with v1.0
ROC worksheet — requirement assessment
The reference structure of the Report on Compliance (Annex 3 §A3.7). The report has 15 main sections; each requirement gets an assessment worksheet.
v0.2 draft -> v1.0
Coming with v1.0
ROC worksheet — requirement assessment
The reference structure of the Report on Compliance (Annex 3 §A3.7). The report has 15 main sections; each requirement gets an assessment worksheet.
v0.2 draft -> v1.0
Coming with v1.0
ROC worksheet
Tools are the interactive layer of the standard: the self-assessment, checklists and worksheets you fill in on the site. They help you prepare for an audit, surface gaps early, and see which controls are already covered. A self-assessment is not a certification: a full audit is performed annually for all levels (Section D.4.1).