Readiness self-assessment
A short 15-question self-assessment distilled from the eight Critical Requirements and the standard's must-pass gates. The output is an indicative readiness level (L1/L2/L3, or "not ready yet") with links into the relevant parts of the standard. It is neither a certification nor the SAQ.
Answer "Yes / Partial / No" for each item. The questions cover the eight Critical Requirements (B.1.1, B.1.2, B.2.1, B.3.1, B.4.1, B.5.2, B.7.3, B.8.1) and the must-pass gates: zero "Not in Place" findings, the cold-storage share, the ban on plaintext key storage, the revocation SLA and the watch-only monitoring SLA. Any unmet gate means the organization is not yet ready to certify at any level.
The result is indicative and is not a statement of compliance. A full assessment is performed via SAQ-C1 and the annual CCSA-QSA audit.
A "Partial" answer on a gate question counts as failing the gate.
Readiness self-assessment
A "Partial" answer on a gate question counts as failing the gate.
Questions answered
0 / 15
01Do you maintain a complete, living inventory of all cryptographic material (CCM), classified into categories A–F? (B.1.1)
02Is the Cryptographic Material Environment (CME) defined, documented and segmented? (B.1.2)
03Are keys generated from a qualified, verifiable entropy source (TRNG/DRBG/HSM/Secure Enclave/СКЗИ), with no Math.random(), time-based seeds or un-augmented user entropy? (B.2.1)
04Is Critical Cryptographic Material stored in an HSM, an MPC envelope or a Secure Enclave per the level? (B.3.1)
05Is plaintext key storage excluded from .env, repositories, container images, logs and localStorage?
06Does the cold-storage share of AUM meet the target-level threshold (L1 ≥65%, L2 ≥85%, L3 ≥95%)?
07Is signing performed inside the trusted boundary so the private key never leaves it (HSM / MPC / Secure Enclave / TEE)? (B.4.1)
08Are SMS, email links and push-without-challenge excluded as 2FA methods for signing operations?
09Is a revocation playbook documented with the SLA: confirmed compromise ≤15 minutes, suspected ≤1 hour? (B.5.2)
10Are multi-sig thresholds met by balance/context (no single-signature wallet above $1M)?
11Is watch-only monitoring connected to all production wallets with a discrepancy-detection SLA (L1 ≤5 min, L2 ≤1 min, L3 ≤30 sec)? (B.7.3)
12Does reconciliation cover discrepancies between on-chain activity and signing logs?
13Has a background check of personnel with CCM access been performed at the required periodicity? (B.8.1)
14Do you confirm that no mandatory requirement is 'Not in Place' (0% Not in Place is required at every level)?
15Is the organization ready to undergo an annual full audit (evidence collected and available on request)?
Indicative result
Answer "Yes / Partial / No" for each item. The questions cover the eight Critical Requirements (B.1.1, B.1.2, B.2.1, B.3.1, B.4.1, B.5.2, B.7.3, B.8.1) and the must-pass gates: zero "Not in Place" findings, the cold-storage share, the ban on plaintext key storage, the revocation SLA and the watch-only monitoring SLA. Any unmet gate means the organization is not yet ready to certify at any level.
The result is indicative and is not a statement of compliance. A full assessment is performed via SAQ-C1 and the annual CCSA-QSA audit.
Get certified
A short 15-question self-assessment distilled from the eight Critical Requirements and the standard's must-pass gates. The output is an indicative readiness level (L1/L2/L3, or "not ready yet") with links into the relevant parts of the standard. It is neither a certification nor the SAQ.