Get Certified — for Companies
Turn the work you have already done for PCI DSS, ГОСТ 57580 or SOC 2 into a recognized badge for the protection of cryptographic material. CCSA certifies only the protection of Critical Cryptographic Material (CCM).
CCSA confirms that your product's cryptographic material is protected to a verifiable level. Certification is built around four normative segments: pick the one you actually operate in and move toward a public entry in the LVCS registry.
The path: readiness self-assessment -> gap remediation -> formal assessment via an accredited CCSAC -> AOC -> public LVCS listing.
Who each tab addresses
The page content adapts to each segment. Choose the tab that matches your key-handling model.
Who this addresses
VASPs, ЦФА custody services, AUM $10M–$500M, already on ГОСТ 57580 or SOC 2.
Pain
Insider risk, operational mistakes, insurers refusing cover without proven key protection.
Target level: L2–L3.
Segments and levels (L1/L2/L3 × C.1–C.4)Who this addresses
Wallets with 50k+ active users, 3+ chains, often open-source.
Pain
Build / supply-chain compromise, secret extraction from a running app (Secure Enclave / StrongBox).
Target level: L1 (startup) -> L2 (mature).
Segments and levels (L1/L2/L3 × C.1–C.4)Who this addresses
Daily volume $1M+, regulated in the EAEU/CIS.
Pain
Hot-wallet theft, session-token theft on withdrawal endpoints, real-time compromise detection.
Target level: L2 mandatory, L3 for leaders.
Segments and levels (L1/L2/L3 × C.1–C.4)Who this addresses
Stablecoin / RWA / fiat-token issuers, market cap $5M+, transparent reserves.
Pain
Mint/burn key protection (Critical B.4.1), multisig and time-lock, mint-authority misuse detection (B.7.3).
Target level: L2 mandatory, L3 for large issuers.
Segments and levels (L1/L2/L3 × C.1–C.4)Which domains are mandatory for your segment
M — Mandatory, R — Recommended, N-A — Not Applicable. The level (L1/L2/L3) in each segment is set by its own scale metric.
| B.x | C.1 | C.2 | C.3 | C.4 |
|---|---|---|---|---|
| B.1 | M | M | M | M |
| B.2 | M | M | M | M |
| B.3 | M | M | M | M |
| B.4 | M | M | M | M |
| B.5 | M | M | M | M |
| B.6 | M | R | M | R |
| B.7 | M | R | M | M |
| B.8 | M | M | M | M |
Three conformance levels across each of the four segments.
Proof of Reserves, AML/KYC/Travel Rule (ФЗ-115), smart-contract security and financial attestation of reserves are out of scope for CCSA. The standard certifies only the protection of Critical Cryptographic Material (CCM). CCSA is not a replacement for ФЗ-115 or AML certification.
Next steps
Register interest in company certification
The standard is still a v0.2 draft — formal certification opens with v1.0. Leave a contact and the Council will reach out when LVCS registry listing becomes available for your segment.
The Council responds within 5 business days.
This opens an email in your mail client with the subject prefilled. The Council does not share contacts with third parties.
No contact data is collected on the site — the email opens in your own mail client.
Start with the readiness self-assessment
The path: readiness self-assessment -> gap remediation -> formal assessment via an accredited CCSAC -> AOC -> public LVCS listing.
The self-assessment is free and is not sent to the Council. It shows your gaps across domains B.1–B.8 so you can move on to matching an accredited CCSAC.