Assessment Methodology
A binary methodology with no numeric scoring: every applicable requirement receives one of five statuses, and the certification level is set by the In-Place ratio, the Compensating-Control ratio and zero Not in Place.
Five requirement-assessment statuses
Each applicable requirement is assessed by the CCSA-QSA auditor in one of five statuses. There is no intermediate status (Partially In Place, partial compliance): any material gap means Not in Place.
Fully implemented via the Defined Approach; all Testing Procedures pass with no findings.
Implemented via the Customized Approach; the Customized Approach Objective is achieved and auditor-verified.
Not implemented, or with critical gaps. Any uncertainty in the implementation is treated as Not in Place.
Out of scope per the requirement's Applicability Notes and the segment matrix; requires justification in the ROC.
An alternative protective measure that meets the criteria of Front Matter §0.8.
Unlike PCI DSS v4.0.1, there is no Not Tested status in CCSA: every applicable requirement must be assessed, or explicitly moved to Not Applicable with justification.
Defined Approach vs Customized Approach
Each requirement can be satisfied in two ways.
The standard path: implement as described in the Defined Approach Requirement; the auditor verifies conformance via the Examine / Interview / Observe / Trace steps.
The alternative path: an arbitrary implementation proven to meet the Customized Approach Objective. Requires a documented implementation, a risk assessment and its own test procedure.
The Customized Approach is forbidden for all eight Critical Requirements — only the Defined Approach is allowed for them (or a CC in strictly limited cases).
Compliance computation
Certification at level L is achieved if and only if all four conditions hold simultaneously.
In Place ratio = (In Place + In Place with Customized Approach) / applicable mandatory requirements
CC ratio = Compensating Control count / applicable mandatory requirements
Conditions for certification at level L
In Place ratio >= threshold(L)
CC ratio <= limit(L)
Not in Place count = 0
All 8 Critical Requirements In Place
Three certification levels
The level is set not by an average score but by the share of applicable mandatory requirements In Place, the permitted CC share, and zero Not in Place. At every level the full audit is annual.
| Level | In Place ratio | Max CC ratio | Not in Place | Target audience |
|---|---|---|---|---|
L1 Level 1 — Foundation | >= 90% | <= 10% | 0 | Early-stage startups, MVPs, small projects with AUM / market cap < $5M |
L2 Level 2 — Standard | >= 95% | <= 5% | 0 | Mature operators, regulated VASPs — the minimum required level ($5M-$500M) |
L3 Level 3 — Advanced | >= 100% | <= 2,5% | 0 | Systemically important players (> $500M), large stablecoin issuers, VASPs in strict jurisdictions |
At every level: full audit annually, 0% Not in Place among mandatory, 100% of Critical Requirements In Place via the Defined Approach.
Any Critical Requirement Not in Place = automatic fail at any level, regardless of the overall In-Place ratio.
Compliance computation
Certification at level L is achieved if and only if all four conditions hold simultaneously.
In Place ratio
95% / 100%
Conditions for certification at level L
>= 90% / CC <= 10%
>= 95% / CC <= 5%
>= 100% / CC <= 2,5%
Any Critical Requirement Not in Place = automatic fail at any level, regardless of the overall In-Place ratio.
Compensating Control limits and approval
A CC applies when a requirement cannot be met via the Defined Approach and the Customized Approach is not applicable, given an equivalent or superior alternative measure verified by the auditor.
| Level | Max CC of mandatory | Approval authority |
|---|---|---|
| L1 | <= 10% | CCSAC |
| L2 | <= 5% | CCSAC + peer review by another CCSAC |
| L3 | <= 2.5% | Council Chief QA Officer |
Each CC is re-validated at the annual audit, on any infrastructure change, and immediately upon an incident the original requirement would have prevented.
The eight Critical Requirements
Foundational requirements under stricter rules: the Customized Approach is always forbidden, carry-over never applies, and any one of them Not in Place means automatic fail.
B.1.1, B.1.2, B.5.2, B.7.3
B.2.1, B.3.1, B.4.1, B.8.1
Re-assessment cycles
The earlier two-year cycle for Level 1 has been removed — the pace of change in crypto infrastructure is incompatible with a 24-month interval.
Level 1: full audit annually + a self-assessment SAQ every 6 months between audits.
Level 2: full audit annually + quarterly compliance review with CCSAC participation; QA sampling of 10% of certifications.
Level 3: full audit annually + continuous monitoring + quarterly review; QA sampling of 100% of certifications annually.
Certification at level L is achieved if and only if all four conditions hold simultaneously.
CCSA Standard
Three certification levels
The level is set not by an average score but by the share of applicable mandatory requirements In Place, the permitted CC share, and zero Not in Place. At every level the full audit is annual.