Can one entity have multiple systems audited under CCSS?

Can one entity have multiple systems audited under CCSS?

Yes.

A single entity can have multiple systems, and each system can be scoped and audited independently.

For example, an organization might have:

A custody platform
A trading or exchange system
An internal treasury system

Each of these could be treated as a separate system if the key management processes, infrastructure, or teams differ.

Each system would:

Define its own Trusted Environment
Be assessed against CCSS requirements
Receive its own certification level

This allows organizations to certify specific parts of their environment without needing to include everything under one scope.

Tags: ,
Date Updated: May 5, 2026
Article Number: 8