Annexe 4 — Variantes SAQ

Annex 4 — SAQ (Self-Assessment Questionnaire) Variants#

A4.0. Purpose#

The Self-Assessment Questionnaire (SAQ) is a tool for:

1. Interim self-assessment for Level 1 (between annual full audits, every 6 months)
2. Preparation for a full audit (any level)
3. Continuous compliance monitoring for Level 2+ (optional)

There are 4 SAQ variants — one per segment (C.1, C.2, C.3, C.4). The structure of each SAQ follows the structure of the standard's domains B.1 — B.8.

The SAQ does not replace a full audit. Per Section D.4.1, a full audit is performed annually for all levels. The SAQ is a supplementary tool, not an alternative.

A4.1. SAQ-C1 — Custodial Wallets and Custodians#

Description#

SAQ for custodial wallets and custodians. Covers the 8 mandatory domains of segment C.1. The complete SAQ-C1 is a reference example (see A4.8).

Length#

Complete SAQ-C1: 30–40 pages + appendices with supporting evidence.

A4.2. SAQ-C2 — Non-custodial Wallets#

Description#

SAQ for non-custodial wallet vendors. Applies to the organization developing the wallet product, not to the end user (see Section C.2.2).

SAQ-C2 specifics#

• Vendor scope questions (build infrastructure, release management, employee controls)
• Device scope questions (on-device entropy, Secure Enclave usage, signing UX)
• Code security questions (reproducible builds, code signing, bug bounty)

Length#

SAQ-C2: 20–30 pages.

A4.3. SAQ-C3 — Crypto Exchanges (CEX and DEX frontends)#

Description#

SAQ for exchanges, covering the 8 mandatory domains of segment C.3.

SAQ-C3 specifics#

• Additional questions on session security for customer wallets
• Withdrawal time-locks (Section B.6.4)
• Real-time reconciliation SLA (Section B.7.3)
• Hot/warm/cold AUM split

Length#

SAQ-C3: 40–50 pages.

A4.4. SAQ-C4 — Issuers of Stablecoins / RWA / fiat-tokens#

Description#

SAQ for issuers, covering the 8 mandatory domains of segment C.4.

SAQ-C4 specifics#

• Focus on mint/burn key protection (Section B.6.1)
• Mint time-lock requirements (Section B.6.4)
• Unauthorized mint detection (Section B.7.3)

Scope note: SAQ-C4 covers only the protection of mint/burn keys and associated CCM. Proof of Reserves, reserve composition, and token holders' rights are out of CCSA scope (Section 0.2.2) and are not included in the SAQ.

Length#

SAQ-C4: 30–40 pages.

A4.5. Common Sections (in all SAQ variants)#

Common Section A — Organization Information#

A1. Organization name (legal entity): _______________________
A2. Type: [ ] Corporate entity  [ ] Partnership  [ ] Other: _____
A3. Legal registered address:
    Street: _______________
    City:   _______________
    Country: ______________
    Postal: _______________
A4. Physical operational address (if different from legal):
A5. Primary contact for assessment:
    Name:  _______________
    Title: _______________
    Email: _______________
    Phone: _______________
A6. Compliance officer:
A7. CEO / General Director:
A8. Year established:
A9. AUM / Market cap / TVL (in USD equivalent; ranges correspond to the level thresholds of segments C.1/C.3/C.4 — see Section C):
    For C.1 / C.3: [ ] < $5M (L1)  [ ] $5M–$500M (L2)  [ ] > $500M (L3)
    For C.4: [ ] < $5M (L1, small issuers)  [ ] $5M–$100M (L2)  [ ] > $100M (L3)
    For C.3 daily volume separately: [ ] < $1M (L1, pilot only)  [ ] $1M–$100M (L2)  [ ] > $100M (L3)
A10. Number of active customer accounts / wallets:
    [ ] < 100  [ ] 100–1K  [ ] 1K–10K  [ ] 10K–100K  [ ] > 100K
A11. Jurisdictions of operation:
A12. Declared CCSA Level: [ ] L1  [ ] L2  [ ] L3
A13. Segment: [ ] C.1  [ ] C.2  [ ] C.3  [ ] C.4

Common Section B — Baseline Certifications#

B1. PCI DSS:
    [ ] Yes — Level [ ] 1 [ ] 2 [ ] 3 [ ] 4
    QSA Company: ___________
    Issue date: ___________
    Valid until: ______________
    [ ] No

B2. GOST R 57580:
    [ ] Yes — Level: [ ] standard [ ] enhanced
    Assessment date: ___________
    [ ] No

B3. SOC 2:
    [ ] Yes — Type [ ] 1 [ ] 2
    Period covered: ___________
    [ ] No

B4. ISO 27001:2022:
    [ ] Yes  [ ] No
    Certification date: _____

B5. CCSS:
    [ ] Yes — Level [ ] I [ ] II [ ] III
    [ ] No
    Certification date: _____

B6. Other relevant certifications (specify):
    _______________________________

Common Section C — Declaration#

By signing below, the undersigned represents that the answers provided
in this Self-Assessment Questionnaire are accurate to the best of
his/her knowledge as of the date of signing, and that supporting evidence will be
provided to the CCSA-QSA upon request.

The undersigned acknowledges that:
- The SAQ does not replace the full annual audit
- False statements in the SAQ may lead to suspension of certification
- The Council may request additional evidence at any time

Name (printed): ________________________
Title: _________________________________
Date: __________________________________
Signature: _____________________________

Organization: __________________________

A4.6. SAQ Usage Rules#

A4.6.1. Interim Level 1 self-assessment#

Assessed Entities certified at Level 1 complete the SAQ every 6 months between annual full audits (see Section D.4.2):

• The SAQ is completed by the client
• Supporting evidence is retained and available upon CCSAC request
• Results are retained in Council records
• Failure to meet an SAQ requirement without correction = trigger for an interim full audit

A4.6.2. Pre-Audit Preparation#

Assessed Entities preparing for a full audit (any level) may complete the SAQ 60–90 days before the audit:

• Identifies gaps before the audit
• Allows remediation before the audit
• Simplifies CCSA-QSA scope planning

A4.6.3. Continuous Compliance Monitoring (Level 2+)#

Level 2 and Level 3 organizations may complete the SAQ quarterly as part of continuous monitoring:

• Self-attestation of compliance status
• Reporting to the Council (optional)
• Basis for a quarterly compliance review with CCSAC participation

A4.7. SAQ Tooling#

A4.7.1. Council-Provided Tool#

The Council provides an online SAQ platform:

• Available to Members tier Standard+
• Auto-validation of answer structure
• Evidence upload and management
• Sharing with CCSAC for review

A4.7.2. Open-Source Alternative#

The Council publishes SAQ templates in Word, PDF, and Markdown for self-administered use.

A4.8. SAQ-C1 — Reference Question Library (Custodial Wallets)#

Below is the complete reference question library of SAQ-C1 as an example. SAQ-C2 / C3 / C4 are built on a similar structure with segment-specific questions.

SAQ-C1 Section 1 — Organization Information#

See Common Section A above.

SAQ-C1 Section 2 — Baseline Certifications#

See Common Section B above.

SAQ-C1 Section 3 — Domain B.1: CCM Inventory and Classification#

3.1 [B.1.1] Is a documented CCM Inventory maintained?
    [ ] Yes  [ ] No
    If Yes, specify the format: [ ] CMDB  [ ] Spreadsheet  [ ] Vault paths  [ ] Other: _____
    Evidence reference: ________________

3.2 [B.1.1] Does the inventory include all applicable CCM categories (A–F)?
    [ ] Yes, all applicable  [ ] Partially  [ ] No
    Which categories are applicable: [ ] A [ ] B [ ] C [ ] D [ ] E [ ] F
    Evidence: ________________

3.3 [B.1.1] Does each inventory record contain: category, description,
    technology, primary storage location, owner?
    [ ] Yes  [ ] Partial  [ ] No
    Evidence: ________________

3.4 [B.1.2] Is the Cryptographic Material Environment (CME) documented?
    [ ] Yes  [ ] No
    Evidence (CME diagram reference): ________________

3.5 [B.1.2] Is network segmentation applied to reduce the CME?
    [ ] Yes  [ ] No
    If Yes, types of segmentation:
    [ ] Network firewalls  [ ] VLAN  [ ] Application isolation
    [ ] Container isolation  [ ] Hardware boundary (HSM)
    Evidence: ________________

3.6 [B.1.2] Is segmentation testing performed annually?
    [ ] Yes — date of last test: _____
    [ ] No  [ ] N/A (L1 without segmentation)
    Evidence (test report reference): ________________

3.7 [B.1.3] Is the data flow documented for each applicable CCM category?
    Includes: generation / storage / access / usage / transmission / destruction?
    [ ] Yes, fully  [ ] Partially  [ ] No
    Evidence (data flow diagrams reference): ________________

3.8 [B.1.4] Is a quarterly review of the CCM inventory performed?
    [ ] Yes — date of last review: _____
    [ ] Every 6 months (L1)  [ ] No
    Evidence (review records): ________________

3.9 [B.1.4] Is the inventory updated within 5 business days on event-triggered changes?
    [ ] Yes  [ ] No
    Examples in the last 12 months: ________________

SAQ-C1 Section 4 — Domain B.2: Generation of CCM#

4.1 [B.2.1] Which entropy sources are used for CCM generation?
    [ ] Hardware TRNG FIPS 140-3 L3+
    [ ] NIST SP 800-90A DRBG
    [ ] HSM internal RNG with FIPS certificate
    [ ] SKZI KS2 (for Russian clients, L1)
    [ ] SKZI KS3 (for Russian clients, L2)
    [ ] SKZI KV1 (for Russian clients, L3)
    [ ] Other: _____
    Evidence (vendor certificates): ________________
    Note: SKZI classes — see Annex 2 A2.2 (KS2 minimum L1, KS3 minimum L2, KV1 minimum L3 for Russian clients).

4.2 [B.2.1] Has entropy testing been performed (NIST SP 800-22, FIPS 140-2 statistical)?
    [ ] Yes — last test: _____  [ ] No
    Evidence: ________________

4.3 [B.2.2] Is an air-gapped environment used for the cold storage ceremony?
    [ ] Yes (L2+)  [ ] Dedicated VM without shared credentials (L1)  [ ] No
    Evidence: ________________

4.4 [B.2.3] Is the Key Ceremony protocol documented?
    [ ] Yes  [ ] No
    Includes: pre-ceremony checklist, roles, step-by-step protocol, verification,
    post-ceremony actions, sign-off?
    [ ] All elements  [ ] Partially  [ ] None
    Evidence (template + most recent ceremony record): ________________

4.5 [B.2.3] Multi-person ceremony for cold storage?
    [ ] 2-of-3 participants  [ ] 3-of-5  [ ] More  [ ] Single-person (L1 only)
    [ ] Independent witness (L3)
    Evidence: ________________

4.6 [B.2.4] Is verification performed immediately after generation (address
    derivation, signing test, negative test for MPC)?
    [ ] Yes — for all categories  [ ] Partially  [ ] No
    Evidence (verification logs): ________________

SAQ-C1 Section 5 — Domain B.3: Storage of CCM#

5.1 [B.3.1] Which storage mechanism is used for category A (Master)?
    [ ] HSM FIPS 140-3 L3+ (L3)
    [ ] HSM FIPS 140-2 L3+ (L1/L2)
    [ ] MPC ≥ 3-of-5 with geographic distribution (L3)
    [ ] MPC ≥ 2-of-3 (L1/L2)
    [ ] Hardware wallet (certified)
    [ ] Software vault (only L1 with AUM < $500K + CC)
    Evidence (vendor certificate + configuration): ________________

5.2 [B.3.1] Is storage of CCM prohibited in:
    [ ] Yes to all / [ ] No
    - Plaintext config files (.env)
    - Source code repositories
    - Container images
    - Environment variables without encryption-at-runtime
    - Database fields without application-level encryption
    - Application logs, error tracking systems
    - Browser localStorage in plaintext

5.3 [B.3.1] Is secrets scanning used (TruffleHog, gitleaks, GitGuardian)?
    [ ] Yes — frequency: ___  [ ] No
    Evidence (latest scan report): ________________

5.4 [B.3.2] Which AEAD cipher is used for encryption-at-rest of CCM?
    [ ] AES-256-GCM  [ ] AES-256-GCM-SIV  [ ] ChaCha20-Poly1305
    [ ] GOST R 34.12 Kuznyechik MGM (for RF)
    [ ] Other: _____
    Evidence: ________________

5.5 [B.3.2] Where is the Master Encryption Key (MEK) stored?
    [ ] HSM in an independent location  [ ] KMS  [ ] MPC
    [ ] Same location as encrypted CCM (FAIL)
    Evidence: ________________

5.6 [B.3.3] What share of AUM is in cold storage (for C.1 / C.3)?
    [ ] ≥ 95% (L3 target)  [ ] ≥ 85% (L2 target)  [ ] ≥ 65% (L1 target)  [ ] < 65% (FAIL)
    Calculation date: _____
    Methodology: [ ] Notional USD value  [ ] Number of keys  [ ] Other

5.7 [B.3.4] Backup CCM in geographically distributed locations?
    [ ] ≥ 3 jurisdictions (L3)  [ ] ≥ 2 jurisdictions (L2)
    [ ] ≥ 2 locations same jurisdiction (L1)  [ ] Single location (FAIL)
    Evidence: ________________

5.8 [B.3.4] Is test restoration of backups performed quarterly (L2+)?
    [ ] Yes — last test: _____  [ ] Annually (L1)  [ ] No
    Evidence (test report): ________________

SAQ-C1 Section 6 — Domain B.4: Usage of CCM#

6.1 [B.4.1] Does a private key leave the trusted boundary (HSM / MPC / Secure Enclave)
    for signing operations?
    [ ] Never (correct)  [ ] Sometimes (FAIL)  [ ] Always (FAIL)
    Evidence (signing architecture diagram): ________________

6.2 [B.4.2] Multi-person authorization for signing operations:

    Amount < $1K: [ ] Auto-approve  [ ] 1-person manual
    $1K – $10K: [ ] 1-person  [ ] 2-person
    $10K – $100K: [ ] 2-person  [ ] 2-person + time-lock
    $100K – $1M: [ ] 2-person + time-lock  [ ] 3-person multi-sig  [ ] 4-of-7 + time-lock
    > $1M: [ ] 3-person  [ ] 4-of-7  [ ] 5-of-9 + time-lock

    Does it match the table for the applicable Level?
    [ ] Yes  [ ] No

    Conversion rate methodology: [ ] Midpoint primary pricing feed at initiation
    [ ] Other: _____

6.3 [B.4.3] Cookies set HttpOnly + Secure + SameSite=Strict?
    [ ] Yes  [ ] No

6.4 [B.4.3] Which 2FA methods are accepted for signing operations?
    [ ] TOTP (RFC 6238)  [ ] FIDO2 / WebAuthn  [ ] Biometric with Secure Enclave
    [ ] Hardware token (RSA SecurID and equivalents)
    [ ] SMS (FAIL — prohibited by NIST SP 800-63B)
    [ ] Email link (FAIL)
    [ ] Push without challenge (FAIL)

6.5 [B.4.3] Step-up authentication for operations > $50K (L3) or > $100K (L2)?
    [ ] Yes  [ ] No

6.6 [B.4.3] DPoP (RFC 9449) implemented?
    [ ] Yes (L3 mandatory)  [ ] No

6.7 [B.4.4] PAM solution for privileged access to CCM infrastructure?
    [ ] CyberArk  [ ] BeyondTrust  [ ] Teleport  [ ] Indeed PAM  [ ] Other: _____
    [ ] No PAM (FAIL for L2+)
    Evidence (PAM configuration): ________________

6.8 [B.4.4] Kill-switch mechanism for privileged sessions?
    [ ] Yes — description: ________________
    [ ] No

SAQ-C1 Section 7 — Domain B.5: Lifecycle Management#

7.1 [B.5.1] CCM rotation cadence (for all 6 categories):

    A1 (Master / hot wallet keys): [ ] 3 mo (L3)  [ ] 6 mo (L2)  [ ] 12 mo (L1)
    A2 (Cold storage keys):        [ ] 24 mo (L3)  [ ] 36 mo (L2)  [ ] 12 mo (L1 default) / 36 mo (L1 exception)
    B (MPC shares):                [ ] 6 mo (L3)  [ ] 12 mo (L1/L2)
    C (Hardware-bound keys):       [ ] Per vendor recommendation (L1)  [ ] Annual (L2)  [ ] Annual + post-incident (L3)
    D (Sessions):                  See Section B.4.3 (TTL: ≤15 min access / ≤5 min signing-scoped)
    E (API keys):                  [ ] 3 mo (L3)  [ ] 6 mo (L2)  [ ] 12 mo (L1)
    F (Recovery materials):        [ ] 12 mo (L3)  [ ] 24 mo (L2)  [ ] 36 mo (L1)

    If cold storage is 36 mo for L1 — are all conditions of Applicability Note B.5.1 confirmed?
    [ ] Air-gapped  [ ] Multi-sig 2-of-3+  [ ] No ad-hoc access  [ ] All access logged
    [ ] Risk acceptance documented  [ ] All conditions met

7.2 [B.5.1] Is triggered rotation on offboarding performed within SLA?
    L1 ≤ 24h / L2 ≤ 4h / L3 ≤ 1h
    [ ] Yes  [ ] No

7.3 [B.5.2] Is a revocation playbook documented for each CCM category?
    [ ] Yes  [ ] No
    SLA: Confirmed compromise ≤ 15 min? [ ] Yes [ ] No
         Suspected compromise ≤ 1h?     [ ] Yes [ ] No
    Evidence (playbook reference): ________________

7.4 [B.5.3] Has the recovery procedure been tested in the last 12 months?
    [ ] Annual drill (L2)  [ ] Quarterly tabletops + annual drill (L3)
    [ ] Annual tabletop (L1)  [ ] No
    RTO for the applicable Level: L1 ≤ 72h / L2 ≤ 24h / L3 ≤ 4h
    Achieved?  [ ] Yes  [ ] No

7.5 [B.5.4] Disposal procedure for each storage type?
    [ ] Yes  [ ] No
    Cryptographic erasure for software-stored CCM?  [ ] Yes  [ ] No
    HSM zeroization on decommissioning?  [ ] Yes  [ ] No
    Physical destruction for L3?  [ ] Yes  [ ] No  [ ] N/A
    Evidence (disposal certificates): ________________

SAQ-C1 Section 8 — Domain B.6: Wallet Architecture#

8.1 [B.6.1] Multi-signature threshold for wallets > $100K aggregate balance?
    [ ] Recommended single-sig + monitoring (L1, $100K–$1M, per B.6.1 Mandatory Thresholds)
    [ ] 2-of-3 (L1 > $1M, L2 > $100K)  [ ] 3-of-5 (L2 > $1M, L3 > $100K)  [ ] 4-of-7 or higher (L3 > $1M)
    [ ] Single-sig for wallets > $1M (FAIL — violation of Mandatory Threshold)

8.2 [B.6.1] Geographic distribution of keyholders (L3)?
    [ ] ≥ 3 jurisdictions  [ ] ≥ 2 jurisdictions  [ ] Same jurisdiction
    Evidence: ________________

8.3 [B.6.2] Watch-only monitoring for all production wallets?
    [ ] Yes — all  [ ] Partially  [ ] No

8.4 [B.6.3] Architectural isolation between hot/warm/cold tiers?
    [ ] Cold air-gapped + warm restricted + hot DMZ  [ ] Logical separation  [ ] None

8.5 [B.6.4] Withdrawal time-locks for high-value operations:

    > $10K:   [ ] 1h (L2)  [ ] 4h (L3)  [ ] None (L1)
    > $100K:  [ ] 24h (L1/L2)  [ ] 72h (L3)
    > $1M:    [ ] 24h (L1)  [ ] 72h (L2)  [ ] 168h (L3)

8.6 [B.6.5] Whitelisting of destination addresses for institutional accounts?
    [ ] Yes  [ ] No
    Multi-person approval for adding a new address?  [ ] Yes  [ ] No
    Cooling-off period for new addresses?  [ ] Yes — duration: ___  [ ] No

SAQ-C1 Section 9 — Domain B.7: Compromise Detection and Monitoring#

9.1 [B.7.1] Comprehensive logging of CCM events with required fields?
    [ ] Yes  [ ] Partial  [ ] No

9.2 [B.7.1] Log integrity: cryptographic hash chaining between entries?
    [ ] Yes  [ ] WORM storage only  [ ] No

9.3 [B.7.1] Log retention:
    [ ] L1: 12 mo  [ ] L2: 24 mo  [ ] L3: 36 mo

9.4 [B.7.2] Anomaly detection mechanism:
    [ ] Rule-based (L1)  [ ] Statistical baselines (L2)  [ ] ML-based (L3)

9.5 [B.7.3] Watch-only reconciliation SLA:
    Time to detection:  [ ] L1 ≤ 5 min  [ ] L2 ≤ 1 min  [ ] L3 ≤ 30 sec
    Time to response:   [ ] L1 ≤ 30 min  [ ] L2 ≤ 15 min  [ ] L3 ≤ 5 min

9.6 [B.7.3] Does reconciliation cover discrepancies between on-chain activity and signing logs?
    [ ] Yes  [ ] No

9.7 [B.7.4] Does the Incident Response Playbook cover all required scenarios?
    [ ] Hot wallet drain  [ ] HSM compromise  [ ] MPC participant compromise
    [ ] Session token mass-leak  [ ] Insider exfiltration  [ ] Vendor-side incident
    [ ] Custodial wallet phishing campaign

9.8 [B.7.4] Was an annual tabletop exercise conducted?
    [ ] Yes — date: ___  [ ] No

SAQ-C1 Section 10 — Domain B.8: Personnel and Access Control#

10.1 [B.8.1] Background check elements for CCM personnel:
     [ ] Identity verification  [ ] Criminal record (7 years)  [ ] Financial background
     [ ] Employment history (5 years)  [ ] Reference checks  [ ] Education verification
     [ ] Sanctions / PEP screening
     Periodicity: [ ] L1/L2 every 3 years  [ ] L3 every 2 years

10.2 [B.8.2] Documented SoD policy with functional segregation matrix?
     [ ] Yes  [ ] No
     Automated conflict detection?  [ ] Yes  [ ] Manual review  [ ] No

10.3 [B.8.2] Quarterly access review (L2+)?
     [ ] Yes — last review: ___  [ ] Annual only (L1)  [ ] No

10.4 [B.8.3] Does onboarding include all pre-access requirements?
     [ ] Background check completed  [ ] NDA signed  [ ] Code of Conduct
     [ ] CCM Training completed  [ ] Comprehension test passed (≥ 80%)
     [ ] Multi-person approval (for keyholders)
     Probationary period: [ ] L1 30 days  [ ] L2 60 days  [ ] L3 90 days

10.5 [B.8.4] Offboarding SLA:
     Disable accounts:        [ ] L1 ≤ 8h  [ ] L2 ≤ 4h  [ ] L3 ≤ 1h
     Revoke physical access:  [ ] L1 ≤ 8h  [ ] L2 ≤ 4h  [ ] L3 ≤ 1h
     Temporary multi-sig suspension: [ ] L3 immediately  [ ] L2 ≤ 4h  [ ] L1 ≤ 8h
     Triggered rotation:      [ ] L1 ≤ 24h  [ ] L2 ≤ 4h  [ ] L3 ≤ 1h
     Permanent reshare:       [ ] L1 ≤ 7 days  [ ] L2 ≤ 48h  [ ] L3 ≤ 24h

10.6 [B.8.5] Geographic distribution of keyholders for L2+?
     [ ] ≥ 3 jurisdictions (L3)  [ ] ≥ 2 jurisdictions (L2)  [ ] Same jurisdiction (FAIL for L2+)
     Backup keyholders in each jurisdiction?  [ ] Yes  [ ] No
     Quarterly accessibility verification (L3)?  [ ] Yes  [ ] No

SAQ-C1 Section 11 — Final Attestation#

11.1 All questions above answered truthfully:  [ ] Yes  [ ] No

11.2 Supporting evidence retained and ready for provision:  [ ] Yes  [ ] No

11.3 Critical Requirements (B.1.1, B.1.2, B.2.1, B.3.1, B.4.1, B.5.2, B.7.3, B.8.1):
     All In Place?  [ ] Yes  [ ] No — list of non-compliant: ___________

11.4 Applied Compensating Controls (if any): _______________________

11.5 Customized Approach Objectives applied (if any): _______________

11.6 Critical observations self-identified: ____________________

11.7 Planned remediation actions: ________________________________________

(See Common Section C — Declaration for the signature block.)

A4.9. SAQ-C2 / C3 / C4 — Reference Structure#

SAQ-C2 / C3 / C4 follow the same general structure (Sections 1-11), but with questions specific to the corresponding segment:

• SAQ-C2: questions focus on vendor scope (build infrastructure, release management) and device scope (on-device generation, Secure Enclave usage); questions for Domain B.3.3 (Hot/Warm/Cold tiering) and B.4.2 (Dual Control) are marked N/A.

• SAQ-C3: includes additional questions on session security for customer wallets (Domain B.4.3 expanded), real-time reconciliation, and withdrawal limits enforcement.

• SAQ-C4: focuses on mint/burn key protection (Domain B.6.1 on mint keys), mint time-locks (Domain B.6.4), unauthorized mint detection (Domain B.7.3).

The complete question libraries of SAQ-C2 / C3 / C4 are published by the Council as separate documents upon release of CCSA v1.0.

Related#

• 15 — Annex 3 — ROC Reporting Template — previous
• 17 — Annex 5 — AOC Template — next
• 12 — Section D — Certification Levels — Level 1 SAQ usage rules

Sources#

See Section 0.4 Normative References in the Front Matter.

Conceptual reference: PCI DSS SAQ variants (PCI SSC) for the SAQ-building approach; the CCSA SAQ is adapted to the segment-based architecture.