Annexe 1 — Glossaire

Annex 1 — Glossary#

Sorting rule. Terms are split into two blocks: (1) English-language terms and abbreviations (Latin alphabet, A–Z), then (2) Russian terms (Cyrillic alphabet, А–Я). Bilingual correspondences for translation are provided in a separate table at the end.

---

A#

AEAD (Authenticated Encryption with Associated Data) — a mode of symmetric encryption with built-in data authentication (for example, AES-GCM, ChaCha20-Poly1305, Kuznyechik-MGM). See Section B.3.2.

AOC (Attestation of Compliance) — the final public declaration of compliance with the standard. Template — Annex 5.

Assessed Entity — the organization undergoing a CCSA audit. The single normative term of the standard, mandatory in all normative sections, ROC, and AOC. In the headers of Russian-language documents and in informal descriptions, an explanatory translation ("organization that is a candidate for certification") may appear; the normative usage is exclusively "Assessed Entity".

B#

Background check — verification of an individual's background prior to granting access to CCM. See Section B.8.1.

Baseline certificate — a valid certificate of compliance with one of the baseline standards (PCI DSS, GOST 57580, CCSS, SOC 2 Type 2, MiCA) that may be used for carry-over into CCSA. See Section A.

Bug bounty — a program that rewards external researchers for discovering and responsibly disclosing vulnerabilities.

C#

Carry-over — a procedure by which a CCSA requirement may be deemed achieved (status In Place) where the Assessed Entity holds a valid baseline certificate of compliance. Carry-over does not apply to Critical Requirements. Details — Section A.

CCM (Critical Cryptographic Material) — the core term of the standard. Data whose compromise grants direct or derived access to control over crypto assets. Full definition and categories — Section B.1.1.

CCSA — Crypto Custody & Security Assurance — the present standard.

CCSAC (CCSA Company) — an audit firm accredited by the Council to conduct CCSA audits.

CCSA Lead Auditor — the senior level of individual CCSA certification; confers the right to sign ROC and AOC.

CCSA Practitioner — the entry level of individual CCSA certification; confers the right to participate in audits as part of a CCSAC team, but not to sign ROC/AOC.

CCSA-QSA — Qualified Security Assessor, an individual auditor certified by the Council; the intermediate level between CCSA Practitioner and CCSA Lead Auditor.

CCSS (CryptoCurrency Security Standard) — the C4 industry standard for cryptographic key management.

CDE (Cardholder Data Environment) — a PCI DSS term describing the environment in which payment card data is processed. The CME in CCSA is a conceptual analog of the CDE.

CME (Cryptographic Material Environment) — the boundaries of the environment in which CCM is processed. See Section B.1.2.

Cold storage — storage of CCM without permanent online connectivity. See Section B.3.3.

Compensating Control (CC) — an alternative protective measure used where a standard requirement cannot be met and the Customized Approach cannot be applied. See Section 0.8.

Council (CCSA Council) — the organization that issues, updates, and interprets the CCSA standard. See Section 0.1, 0.13.1.

Critical Requirement — a requirement of the standard marked as critical: the Customized Approach is not permitted; for fully-forbidden CC (4 requirements: B.1.1, B.1.2, B.5.2, B.7.3) a Compensating Control is prohibited entirely; for restricted CC (4 requirements: B.2.1, B.3.1, B.4.1, B.8.1) a Compensating Control is permitted only at Level 1 with mandatory approval of the Council Chief QA Officer. Full list — Section D.2.5.

Custodial wallet — a wallet in which the private keys are under the control of the provider. Segment C.1.

Customer / Relying Party — the end user of the Assessed Entity or a party that relies on the CCSA certification (for example, a regulator, an insurance company, an LVCS client). See Section 0.13.5.

Customized Approach — an alternative path to compliance with a requirement: implementation by any means that demonstrably achieves the Customized Approach Objective. Introduced following the PCI DSS v4.0 model. See Section 0.7.2.

Customized Approach Objective — the statement of the objective that must be achieved when using the Customized Approach.

D#

Defined Approach — the standard path to compliance with a requirement: implementation in the form described in the Defined Approach Requirement of the standard's section, and confirmation through the Defined Approach Testing Procedures. See Section 0.7.2.

Defined Approach Requirement — the formalized normative statement of the requirement (what must be implemented).

Defined Approach Testing Procedures — the numbered steps for verifying compliance (Examine, Interview, Observe, Trace), performed by the CCSA-QSA. See Section 0.7.2.

DPoP (Demonstrating Proof of Possession) — IETF RFC 9449, a proof-of-possession mechanism for session tokens. See Section B.4.3.

Dual control — a principle whereby an operation requires the joint action of two or more individuals. See Section B.4.2.

F#

FIPS 140-3 — the NIST standard for cryptographic modules. See Annex 2.

H#

Hot wallet — a wallet with permanent online connectivity. Low physical protection, high operational availability.

HSM (Hardware Security Module) — a secure hardware device for the safe generation, storage, and use of cryptographic keys. See Section B.3.1.

I#

In Place — a requirement assessment status: the requirement is fully implemented through the Defined Approach; all Testing Procedures passed without findings. See Section 0.7.1.

In Place with Customized Approach — a requirement assessment status: the requirement is implemented through the Customized Approach; the Customized Approach Objective is achieved, as confirmed by the auditor. See Section 0.7.1.

K#

Key ceremony — a formalized procedure for generating, splitting, activating, or destroying CCM, with documentation of roles, the sequence of steps, verification, and video recording (for L2+). See Section B.2.3.

L#

Lead Auditor — see CCSA Lead Auditor.

LVCS (Listed Validated Crypto Solutions) — a public registry of certified products and platforms maintained by the Council. Inclusion in the registry requires CCSA certification.

M#

MEK (Master Encryption Key) — the root key that protects other keys through a cryptographic key hierarchy. CCM Category A.

MPC (Multi-Party Computation) — a cryptographic technique for splitting a private key into shares among several parties, allowing joint use without reconstructing a single private key in any one place.

Multi-sig (multi-signature) — a signing scheme requiring m-of-n signatures. See Section B.6.1.

N#

Non-custodial wallet — a wallet with sole control of the private keys held by the user. Segment C.2.

Not Applicable — a requirement assessment status: the requirement does not apply to the given Assessed Entity per the Applicability Notes and the segment matrix. See Section 0.7.1.

Not in Place — a requirement assessment status: the requirement is not implemented or is implemented with critical gaps. See Section 0.7.1.

O#

Off-chain — recorded or occurring outside the blockchain.

Offboarding — the procedure for terminating access upon departure. See Section B.8.4.

On-chain — recorded or occurring on the blockchain.

Onboarding — the procedure for granting access to a new employee. See Section B.8.3.

P#

PAM (Privileged Access Management) — a system for centralized management of privileged accounts and sessions. See Section B.4.5.

PCI DSS (Payment Card Industry Data Security Standard) — the primary baseline standard for CCSA. See Section A.1.

PII (Personally Identifiable Information) — data that identifies an individual. Protected separately under 152-FZ / GDPR. Does not constitute CCM.

PQC (Post-Quantum Cryptography) — cryptography resistant to attacks using quantum computers; the NIST standards ML-KEM (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205). See Annex 2 A2.3.

Private key — a secret cryptographic key for signing transactions. CCM Category A.

Public key — the open part of a key pair. Does not constitute CCM.

Q#

Quality Assurance Program (QA) — a Council program for quality control of ROCs produced by CCSACs; includes peer review, sampling, sanctions. See Section 0.13.1.

R#

Recovery — the procedure for recovering CCM after loss or compromise. See Section B.5.3.

Revocation — the immediate termination of the validity of CCM upon compromise or suspicion thereof. See Section B.5.2.

ROC (Report on Compliance) — a detailed report on compliance with the standard, produced by the CCSA-QSA. Template — Annex 3.

Rotation — the periodic replacement of CCM with new material. See Section B.5.1.

RPO (Recovery Point Objective) — the maximum tolerable amount of data loss (measured in time). See Section B.5.3.

RTO (Recovery Time Objective) — the maximum tolerable recovery time.

S#

SAQ (Self-Assessment Questionnaire) — a self-assessment questionnaire. See Annex 4.

Seed phrase / Mnemonic — a sequence of words (BIP-39) representing the master entropy for deriving private keys. CCM Category A.

Separation of Duties (SoD) — the separation of duties. See Section B.8.2.

Session token — a temporary credential granting operational access to a custodial wallet on behalf of the user. CCM Category D.

Shamir's Secret Sharing — a cryptographic scheme for splitting a secret among n parties with reconstruction from a threshold k of n. Used for key backup and MPC shares.

SIEM (Security Information and Event Management) — a system for centralized management of security events. See Section B.7.1.

T#

TEE (Trusted Execution Environment) — an isolated hardware execution environment. See Section B.3.1 and Section B.4.1.

Threshold signature — a cryptographic scheme requiring joint signing by k-of-n parties.

Time-lock — a delay in the execution of an operation to provide a protective window. See Section B.6.4.

Trust Services Criteria (TSC) — the AICPA criteria for SOC 2 audits (Security, Availability, Processing Integrity, Confidentiality, Privacy). See Section A.4.

V#

VASP (Virtual Asset Service Provider) — a provider of virtual asset services; a FATF term. Used in MiCA and national crypto regulation.

W#

Watch-only wallet — a watch-only wallet that holds only public keys and has no signing capability. See Section B.6.2.

---

А#

Auditor (Аудитор) — see CCSA-QSA, CCSA Lead Auditor.

Б#

Bank of Russia (Банк России, ЦБ РФ) — the Central Bank of the Russian Federation.

Г#

GOST R 57580 (ГОСТ Р 57580) — a series of Russian information-security standards for financial institutions. See Section A.2.

С#

SKZI (СКЗИ) — cryptographic information protection facilities (Russian: Средства криптографической защиты информации). Certified by the FSB of Russia. See Annex 2 A2.2.

Ф#

FinCERT (ФинЦЕРТ) — the Center for Monitoring and Responding to Computer Attacks in the Credit and Financial Sphere of the Bank of Russia.

FSTEC (ФСТЭК) — the Federal Service for Technical and Export Control of Russia.

---

Bilingual correspondences (RU <-> EN)#

Related#

• 12 — Section D — Certification Levels — previous
• 14 — Annex 2 — Algorithm Requirements — next

Sources#

See Section 0.4 (Normative References) and Section 0.3 (Definitions) of the Front Matter.