The first step to getting audited is to select a CCSSA. You can search our currently certified CCSSAs here. Entities then contact and negotiate with the CCSSA of their choosing. Please note that while these individuals have proven their knowledge of the CCSS, C4 does not endorse specific CCSSAs. It is imperative that entities follow best practices for selecting an auditor.
All CCSS audits cover a period of time prior to audit completion and will test the operating effectiveness of the control over this period of time. Audits are designed to be performed at least annually and cover the preceding 12 month period. All audits performed by CCSSAs are reviewed by a CCSSA-Peer Reviewer before C4 certifies an entity. Any dispute arising out of the peer review process shall be arbitrated by the CCSS Steering Committee.
The CCSSA is responsible for ensuring all data related to the audit is transmitted and stored in a secure manner for the duration of the Certificate of Compliance (CoC) and as legally required in the jurisdiction of the audit. C4 will not view documentation of evidence outside the Summary Report on Compliance (SRoC). The CCSS steering committee shall review evidentiary documentation in the case of a peer review dispute.
*Text version of this image can be found in the Auditor’s Guide.
What is a CryptoCurrency Security Standard Auditor (CCSSA)?
A CryptoCurrency Security Standard Auditor is an expert in the CCSS. CCSSAs are able to apply the CCSS standard to any information system that uses cryptocurrencies, calculating a grade for the system according to the CCSS.
CCSSAs must avoid any potential conflict of interest. This may include current or previous employment, familial relationships, financial interest (such as tokens or equity held), or any other matters that may constitute a conflict of interest.
Learn how to become a CCSSA here.