Preparation roadmap
Seven stages: from a readiness self-assessment to a public LVCS registry entry. Each stage lists its owner, duration, output artifact and preparation tips.
The path is end-to-end: self-assessment -> AOC -> public LVCS listing. Durations are indicative and depend on the target level and the current state of controls.
On this page
Owner
Duration
Output artifact
Tip
Preparation roadmap
Seven stages: from a readiness self-assessment to a public LVCS registry entry. Each stage lists its owner, duration, output artifact and preparation tips.
Output artifact
Completed readiness checklist, gap list, candidate level.
Start from the segment you actually operate in (C.1–C.4). First map your existing PCI DSS / ГОСТ 57580 / SOC 2 controls — some carry over (Section A). The 8 Critical Requirements (B.1.1, B.1.2, B.2.1, B.3.1, B.4.1, B.5.2, B.7.3, B.8.1) never carry over and must pass via the Defined Approach — check them first.
Output artifact
Documented CCM scope, data-flow, baseline mapping (multi-baseline if PCI + ГОСТ).
Maintain a CCM Inventory (6 categories A–F, 10 mandatory fields) before the auditor arrives — B.1 is a Critical domain, and a stale inventory fails fast.
Output artifact
Remediated controls, evidence package, Compensating Controls documented where used.
Compensating Controls have per-level limits and some are fully forbidden — do not plan CC for Critical Requirements. Cold/warm/hot tiering and AEAD at rest (B.3) are common, expensive fixes — budget early.
Output artifact
Signed CCSAC engagement; verify the CCSAC is accredited for your segment AND level.
Check the public CCSAC registry for segment (C.1–C.4) and level (L1/L2/L3) scope. L3 needs a CCSAC with 5+ CCSA-QSA and 2+ Lead Auditors. Mind the 2-year cooling-off: a firm that recently consulted you cannot audit you.
Output artifact
ROC (Report on Compliance) — confidential. Methodology In Place / Not in Place / N/A / CC, no numeric scoring.
The ROC is fact-based, not narrative — provide observable evidence (on-chain data, configs, ceremony logs). For Critical Requirements the safe path is the Defined Approach.
Output artifact
AOC (Attestation of Compliance) with a public summary; the ROC stays confidential.
The AOC is the public artifact your LVCS entry links to — review the public-summary wording before sign-off.
Output artifact
LVCS Certificate ID + CCSA Badge + public registry entry; the right to use the CCSA Listed logo with the level.
The badge must always show the level (Level 1/2/3) — a generic "CCSA Certified" without a level is forbidden. The annual maintenance fee keeps the status active. Re-certification is annual and usually lighter than the first pass.
A certificate is valid for one year. Annual re-assessment applies to every level (Section D.4): stage 7 loops back to stage 5.
Get certified
The path is end-to-end: self-assessment -> AOC -> public LVCS listing. Durations are indicative and depend on the target level and the current state of controls.