附件 5 — AOC 模板A5v0.2 草案 -> v1.0https://ccsa-council.com/zh/standard/annex-5-aoc
A5
附件 5 — AOC 模板
PCI DSS 类比
PCI DSS 合规性证明 v4.0.1
中文译文供阅读与核对；请同时参阅俄文和英文原文。当前版本为 v0.2 草案。
部分规范性文件： 附件5 标准版： 0.2
附件 5 — AOC（合规证明）模板
A5.0。目的
合规证明 (AOC) 是符合 CCSA 标准的公开声明。它由评估实体、首席审核员（来自 CCSAC）签署，并在理事会列出的验证加密解决方案 (LVCS) 注册表中注册。
与 ROC 不同，AOC 是公开发布的，用于确认客户、监管机构、保险公司和银行合作伙伴的合规性。
A5.1。 AOC结构
==============================================
CCSA Attestation of Compliance (AOC)
==============================================
PART 1 — Identification
PART 2 — Assessed Solution Description
PART 3 — Type of Assessment
PART 4 — Audit Information
PART 5 — Compliance Statement
PART 6 — Public Compliance Summary
PART 7 — Public Findings Summary
PART 8 — Baseline Carry-Over Applied
PART 9 — Compensating Controls Summary
PART 10 — Customized Approach Summary
PART 11 — Validity & Status
PART 12 — Action Plan for Non-Compliant Status (if applicable)
PART 13 — Acknowledgements & Signatures
PART 14 — Council Registration
==============================================
A5.2。 AOC 模板（全文）
+===========================================================+
| |
| CCSA ATTESTATION OF COMPLIANCE |
| CCSA Standard v0.2 (draft toward v1.0) |
| |
+===========================================================+
PART 1 — Identification
-----------------------
Assessed Entity: ____________________________________
Legal Address: ____________________________________
Tax / Registration ID: ____________________________________
Primary Contact: ____________________________________
CCSA Listing ID: ____________________________________
(assigned by Council upon listing)
PART 2 — Assessed Solution Description
--------------------------------------
Product/Service Name: ____________________________________
Product Version: ____________________________________
Brief Description: ____________________________________
____________________________________
Segment Classification:
[ ] C.1 — Custodial Wallets / Custodians
[ ] C.2 — Non-Custodial Wallets (vendor scope)
[ ] C.3 — Cryptocurrency Exchanges (CEX/DEX)
[ ] C.4 — Issuers (Stablecoins / RWA / Fiat-tokens)
Supported Blockchains: ____________________________________
____________________________________
Supported Languages: ____________________________________
Documentation URL: ____________________________________
Website: ____________________________________
PART 3 — Type of Assessment
---------------------------
Assessment Type:
[ ] Initial certification
[ ] Annual re-certification
[ ] Material change re-assessment
[ ] Incident-driven re-assessment
Approach Used:
[ ] Defined Approach only
[ ] Mix of Defined Approach + Customized Approach
[ ] Defined Approach + Compensating Controls
[ ] All three (Defined + Customized + Compensating)
Methodology Notes: ____________________________________
____________________________________
PART 4 — Audit Information
--------------------------
CCSAC (Audit Company): _________________________________
CCSAC Accreditation #: _________________________________
CCSAC Country: _________________________________
Lead Auditor: _________________________________
Lead Auditor CCSA-QSA #: _________________________________
Audit Period: From _________ to _________
ROC Reference: _________________________________
(internal, not public)
Total Audit Effort: ___ person-days
PART 5 — Compliance Statement
-----------------------------
Based on the assessment conducted in accordance with CCSA Standard
(version above) and documented in the associated Report on Compliance,
the undersigned Lead Auditor attests that:
[Assessed Entity Name]
[Assessed Solution Name]
has demonstrated compliance with the requirements of CCSA Standard
at the following level:
[ ] LEVEL 1 (Foundation)
≥ 90% In Place ratio; ≤ 10% CC ratio; 0 Not in Place
All Critical Requirements In Place via Defined Approach
[ ] LEVEL 2 (Standard)
≥ 95% In Place ratio; ≤ 5% CC ratio; 0 Not in Place
All Critical Requirements In Place via Defined Approach
[ ] LEVEL 3 (Advanced)
100% In Place OR ≤ 2.5% CC with Council approval; 0 Not in Place
All Critical Requirements In Place via Defined Approach
Outcome:
[ ] PASS
[ ] CONDITIONAL PASS (see Action Plan PART 12)
[ ] FAIL
This Attestation does NOT constitute:
- A guarantee of absence of vulnerabilities outside the audit scope
- A guarantee of future compliance or security
- An audit of financial statements or reserve adequacy
- An audit of smart contract logic (separate engagement type)
CCSA Standard reduces, but does not eliminate, security risk.
PART 6 — Public Compliance Summary
----------------------------------
Overall Assessment Status:
Total applicable Mandatory requirements: ___
In Place (including In Place with Customized): ___ (___% )
Compensating Control: ___ (___% )
Not in Place: ___ (___% )
Not Applicable: ___
Domain Status Breakdown:
B.1 Cryptographic Material Inventory and Classification: ___% In Place
B.2 Generation of Cryptographic Material: ___% In Place
B.3 Storage of Cryptographic Material: ___% In Place
B.4 Usage of Cryptographic Material: ___% In Place
B.5 Lifecycle Management: ___% In Place
B.6 Wallet Architecture for CCM: ___% In Place
B.7 Compromise Detection and Monitoring: ___% In Place
B.8 Personnel and Access Control: ___% In Place
Critical Requirements (per Section D.2.5):
[ ] All Critical Requirements In Place via Defined Approach
[ ] [If not all] List of non-compliant Critical Requirements: ____________
PART 7 — Public Findings Summary
--------------------------------
Strengths (3–5 highlights):
1. _____________________________________________________
2. _____________________________________________________
3. _____________________________________________________
Areas for Future Improvement (3–5 high-level items):
1. _____________________________________________________
2. _____________________________________________________
3. _____________________________________________________
(Detailed findings are in the Report on Compliance, which is
confidential per ROC Section 14 Confidentiality requirements.)
PART 8 — Baseline Carry-Over Applied
------------------------------------
The following baseline certifications were applied for carry-over
(per Section A):
[ ] PCI DSS v4.0.1: Level ___, expiry _________________
[ ] GOST R 57580: level ___, assessment date __________
[ ] CCSS v8.0: Level ___, expiry _________________
[ ] SOC 2: Type ___, period _________________
[ ] ISO/IEC 27001: Date _________________
[ ] MiCA: Status _________________
[ ] Other: _________________________________________
Percentage of Mandatory requirements addressed via Full carry-over: ___%
Percentage of Mandatory requirements addressed via Partial carry-over: ___%
PART 9 — Compensating Controls Summary
--------------------------------------
Number of Compensating Controls applied: ___
Percentage of Mandatory requirements via CC: ___%
(max for Level: ___%)
High-level CC description (without confidential specifics):
1. _____________________________________________________
2. _____________________________________________________
3. _____________________________________________________
(Full Compensating Controls details are in the ROC.)
PART 10 — Customized Approach Summary
-------------------------------------
Number of requirements addressed via Customized Approach: ___
High-level description Customized Approach implementations:
1. [Requirement ref] — [brief description objective achievement]
2. _____________________________________________________
3. _____________________________________________________
(Full Customized Approach documentation in ROC Section 9.)
PART 11 — Validity & Status
---------------------------
This Attestation is valid:
From: _________________
Until: _________________
Re-assessment required by: _________________
Current Status (filled by Council):
[ ] Active
[ ] Pending renewal (expires within ___ days)
[ ] Suspended (reason: ___________________________)
[ ] Incident-flagged (date: ___________________)
[ ] Terminated (reason: ___________________________)
PART 12 — Action Plan for Non-Compliant Status
----------------------------------------------
[Completed ONLY for a CONDITIONAL PASS or FAIL outcome]
Non-Compliant Items:
| Requirement | Status | Remediation Action | Target Date | Owner |
|-------------|--------|-------------------|-------------|-------|
| B.X.Y | Not in Place | _____________ | YYYY-MM-DD | _____ |
| ... | ... | ... | ... | ... |
Re-validation Plan:
[Description of when and how re-validation will be conducted to
confirm closure of non-compliant items]
PART 13 — Acknowledgements & Signatures
---------------------------------------
LEAD AUDITOR ATTESTATION
By signing, I attest:
(a) I conducted this assessment in accordance with CCSA Standard
and the CCSA Code of Professional Responsibility;
(b) The findings represented in this AOC and associated ROC are based
on evidence collected during the audit period;
(c) I had no prior consulting engagement with the Assessed Entity in
the last 12 months in areas covered by this audit;
(d) This Attestation accurately reflects the results of the assessment;
(e) I understand the limitations of this assessment (see ROC Section 12 Limitations of Assessment).
Name: _________________________________________
Title: Lead Auditor, [CCSAC Name]
CCSA-QSA: # _______________________________________
Date: _________________________________________
Signature: _________________________________________
CCSAC QUALITY MANAGER ATTESTATION
By signing, I confirm:
(a) This AOC and associated ROC have passed internal quality review
per [CCSAC Name]'s Quality Management Procedures;
(b) The Lead Auditor holds a valid CCSA-QSA registration;
(c) The audit team had adequate qualifications for the assessment scope;
(d) Evidence retention complies with ROC Section 14 Confidentiality requirements.
Name: _________________________________________
Title: Quality Manager, [CCSAC Name]
Date: _________________________________________
Signature: _________________________________________
ASSESSED ENTITY EXECUTIVE ATTESTATION
By signing, I, as a duly authorized representative of the
Assessed Entity, attest that:
(a) Information provided to the Lead Auditor was complete and
accurate to the best of our knowledge;
(b) We agree to:
1. Maintain security controls described in the ROC
2. Promptly notify Council of any material change
affecting compliance status (within 72 hours)
3. Cooperate with any Council-initiated Quality Assurance
review (random sampling per Section D.4.3)
4. Apply for re-certification by the date specified in PART 11
5. Notify Council immediately upon any security incident
affecting CCM (per Section B.7.4 regulatory notification)
(c) We acknowledge that this Attestation does not constitute legal,
financial, or insurance advice; it is solely a statement of
security compliance status as of the audit date.
Name: _________________________________________
Title: _________________________________________
Date: _________________________________________
Signature: _________________________________________
PART 14 — Council Registration
------------------------------
This Attestation has been registered in the CCSA Listed Validated
Crypto Solutions (LVCS) Registry under:
Listing ID: _____________________________
Listing Date: _____________________________
Council Officer: _____________________________
Registry URL: https://lvcs.ccsa-council.com/[Listing-ID]
QR Code for verification: [QR placeholder]
==============================================
END OF ATTESTATION OF COMPLIANCE
==============================================
A5.3。 AOC公开披露
A5.3.1。 LVCS 注册表中发布的内容
注册后：
- AOC（部分1–14）的全文——公共PDF
- API 访问的结构化数据：
- 实体名称、细分、级别、日期、审核员、每个域的落实率
- 供评估实体使用的 CCSA 徽章（强制链接到实时注册表条目）
A5.3.2。 NOT 发布了什么
- ROC（完整报告） — 机密
- 工作文件
- 补偿控制详细信息（仅 9 部分中的高级摘要）
- 定制方法实施细节（仅 10 部分中的高级摘要）
- 商业机密信息
- 员工或客户的个人身份信息
- 特定冷存储地址（适用于C.1、C.3）
A5.4。 AOC 更新
A5.4.1。小更新
对于较小的更改（例如，更新联系人或网站 URL），AOC 通过理事会门户网站进行更新，无需完全重新发布。
A5.4.2。重大变化
对于重大变更（新产品、新细分、基础设施的重大变更、新的区块链集成），需要进行重大变更重新评估并发布新的 AOC。
A5.4.3。状态变化
理事会有权在发生事件时更新状态（有效/待续订/暂停/事件标记/终止）。状态变更将在做出决定后的 24 小时内发布在 LVCS 注册表中。
A5.5。 AOC验证
第三方可以通过以下方式验证 AOC：
- LVCS 注册处 在理事会网站上 — 按列表 ID 或组织名称搜索
- API — 编程验证（REST 端点，JSON 响应）
- QR 代码在 AOC PDF — 直接链接到注册表项
A5.6。 AOC 造假检测
当检测到 AOC 的伪造或误传时：
- 理事会删除该列表
- 包含调查结果描述的公开新闻稿（没有敏感的评估细节）
- 在适用的管辖范围内可以提起民事诉讼
- 列入黑名单（通过正式谅解备忘录与其他标准机构共享）
A5.7。多语言出版物
AOC 发行于：
- 俄语（主要用于基于 RF 的 CCSAC）
- 英语（国际）
- 应要求提供其他语言（哈萨克语、乌兹别克语 — 计划用于 Q4 2027+）
所有语言版本具有同等权限。理事会维持翻译之间的核对以保持一致性。
相关
- 16 — Annex 4 — SAQ Variants — 上一页
- 15 — Annex 3 — ROC Reporting Template — AOC 的机密副本
- 12 — Section D — Certification Levels — 确定级别的方法
来源
参见前面的0.4规范性参考文献。
概念参考： PCI DSS AOC v4.0.1 (PCI SSC) — 合规性证明的结构。
该标准正在接受公众咨询。如果您对此部分有意见，请根据需求代码进行说明。
评论此部分草案 v0.2 -> v1.0。在 2027-01-01 之前可能会有更改。