Whether a system should be audited against the CryptoCurrency Security Standard (CCSS) depends on the role it plays in protecting cryptocurrency and digital assets.
Entities that operate systems responsible for protecting key material should implement security controls appropriate to the risks they face. CCSS provides a recognized framework for securing key material.
CCSS certification provides independent verification that a system has been audited against the CCSS requirements by a certified CCSS Auditor (CCSSA). For systems responsible for protecting cryptocurrency and digital assets, certification demonstrates a commitment to recognized security practices and can provide confidence to customers, partners, regulators, and other stakeholders.
Even if an entity does not pursue system certification, it remains responsible for evaluating the security of any third-party systems it relies on for key material used to secure cryptocurrency and digital assets. Using a CCSS-certified third-party system can strengthen an entity’s overall security, but the entity remains responsible for protecting any key material under its control, and its own system must still meet the CCSS requirements to achieve certification.When appropriate, choosing providers with CCSS-certified systems can provide additional assurance that those systems have been independently audited against the Standard.