Why CCSA
No existing player covers all four crypto-infrastructure segments in one methodology tied to a network of QSA assessors. CCSA fills that gap.
Positioning
The only crypto-infrastructure security standard that is simultaneously compatible with PCI DSS / GOST 57580.3 / CCSS, covers 4 segments (wallets, exchanges, custodians, issuers) and is delivered through a network of existing QSA assessors.
Industry security standard for cryptographic material
Window of opportunity
Crypto-infrastructure security in 2026 is fragmented: each segment has its own standardiser, but none covers the protection of cryptographic material as a whole.
| Segment | Who standardises it | The gap |
|---|---|---|
Card payments | PCI SSC (PCI DSS) | Does not cover crypto |
Wallets and exchanges | C4 (CCSS) | Narrow adoption, no enforcement and no accredited-assessor network |
DLT in RU financial institutions | Rosstandart (GOST R 57580.3) | RU only; general IT-security requirements, not custody specifics |
Stablecoins and VASPs in the EU | EBA / ESMA (MiCA) | A regulatory mandate, not a technical standard |
Smart contracts | Private auditors | No common methodology or registry |
Standards market map
Axes: horizontal — from “RU-only” to “global”; vertical — from “market initiative” to “regulator-recognized”.
Regulator-recognized
ГОСТ 57580.3
PCI SSC
MiCA
ISO/TC 307
CCSS (C4)
EEA EthTrust
CCSA
<- RU only
Global ->
Market initiative
CCSA’s target position is the top-right quadrant: a global initiative with regional recognition that no one currently reaches. The path begins as an RU-CIS market initiative and then moves toward recognition.
Comparison with the landscape
CCSA competes for the client’s attention, not to become the standard: we deliberately reference existing baselines rather than replace them.
| Player | What they have | What is missing (present in CCSA) | CCSA’s relation |
|---|---|---|---|
PCI SSC / PCI DSS | Global enforcement through payment brands | Crypto-specific key-protection requirements | Baseline partner; CCSA is an extension for the crypto layer |
C4 / CCSS v8.0 | Crypto key management, open methodology | Exchanges, issuers, regulatory recognition, product registry | Baseline partner and mapping, not a competitor |
ГОСТ Р 57580 | Mandatory in RU for financial institutions | Flexibility for exchanges and wallets, international compatibility | Baseline for RU clients; goal is recognized complement |
ISO / TC 307 | Institutional authority of ISO | Publication speed, certification, assessor registry | Long-term mapping (ISO 22739 / ISO/TR 23576) |
MiCA (EU) | Legal obligation in the EU | Technical measurable requirements, applicability outside the EU | Not a competitor; CCSA is a MiCA-preparation methodology |
EEA EthTrust | A smart-contract standard (3 levels) | Infrastructure and key protection (smart contracts are out of CCSA scope) | Complementary certification, not a replacement for CCSA |
Smart-contract auditors | Deep technical expertise in contract audits | A standardized methodology and registry | Their infrastructure practice may be accredited as CCSAC |
Big 4 / mid-tier | Institutional credibility | Crypto specificity and regional applicability | Goal is to accredit a mid-tier firm as CCSAC (phase 3) |
The CARC lesson
An attempt at self-regulation by large exchanges (Coinbase, Kraken, Bittrex, 2019–2022, CryptoAsset Rating Council) failed for lack of independent governance and regulatory recognition. CCSA deliberately avoids the “exchanges regulate themselves” model — hence an independent Board and a clear absence of conflict of interest.
Scope boundary — deliberately narrow
CCSA protects only Critical Cryptographic Material — by analogy with how PCI DSS protects only cardholder data. Deliberately out of scope: smart-contract security, Proof of Reserves, AML and on-chain monitoring, trading-engine integrity. This is a positioning boundary, not a gap.
Smart-contract security is out of scope (Section 0.2.2)
Proof of Reserves and reserve composition are out of scope
AML and on-chain forensics are out of scope; the Council does not duplicate financial-intelligence functions
Trading-engine integrity and market manipulation are out of scope
Honest positioning
CCSA reduces the risk of cryptographic-material compromise but does not eliminate it. Certification is not a guarantee against an incident.
CCSA complements rather than competes with central-bank requirements; the goal is to become a recognized assessment methodology.
CCSA Council is a private standards organization, not a government regulator.
CCSA Council is a standard setter, not a guarantor.
Draft v0.2 -> v1.0. Subject to change before 2027-01-01.
Positioning
No player covers all 4 target segments in one methodology tied to the QSA-assessor community.