Our CryptoCurrency Security Standard (CCSS) Auditor Exam is now available and audits are underway. Learn more about the CCSS and how to get your system(s) certified.
CryptoCurrency Security Standard (CCSS) is a set of requirements for all information systems that make use of cryptocurrencies, including exchanges, web applications, and cryptocurrency storage solutions. By standardizing the techniques and methodologies used by systems around the globe, end-users will be able to easily make educated decisions about which products and services to use and with which companies they wish to align.
CCSS is designed to complement existing information security standards (i.e. ISO 27001:2013) by introducing guidance for security best practices with respect to cryptocurrencies such as Bitcoin. CCSS is not designed to substitute or replace these standards; in fact, following the CCSS to the letter while ignoring standards like ISO 27001:2013 will likely lead to compromise. CCSS is a cryptocurrency standard that augments standard information security practices. As with any standard, knowledgeable and experienced security professionals and/or auditors are necessary when implementing any information system to ensure coverage of all classes of attack as well as the appropriate handling of all potential risks.
There are different types of cryptocurrency systems, and an Entity can have multiple types of systems. Entities are not certified, but rather systems are certified. Systems can be certified as CCSS Level 1, 2, or 3 with increased security as the levels increase. Systems fall into 3 buckets. Self-Custody, Qualified Service Provider (QSP), and Full System.
A self-custody system has sole control of the private keys that controls that entity’s own funds. Self Custody systems do not have control over customer funds.
A CCSS Qualified Service Provider (QSP) is a system that does not meet all applicable CCSS requirements in totality because there will be some requirements that the system using the service will be either wholly or partially responsible for. Because of this, the QSP can only meet the requirements that they (1) have the ability to control, and (2) are part of the service that they provide.
A CCSS Full System is a system that meets all applicable CCSS requirements in totality. In situations where a system includes a QSP system as part of their system, some CCSS requirements may be met by the QSP system, as determined by the Cryptocurrency Security Standard Auditor (CCSSA).
Audit fees will be determined between the CCSSA and the entity. It is the responsibility of the CCSSA to ensure sufficient time to complete the audit is reflected in the agreed upon fees.
Audit fees must also include the Listing Fee and the CCSSA-PR’s fee, as determined between the CCSSA and the CCSSA-PR. The CCSSA-PR’s fee will be forwarded to the CCSSA-PR by the CCSSA. C4 will send an invoice for the Listing Fee to the CCSSA after approving the SRoC.
The listing fee, paid by the audited system’s entity to the CCSSA, is based on Table 1.
When multiple systems (up to 3) are covered in the same audit, C4 only charges the listing fee of the most expensive system . When auditing 4-6 systems, C4 only charge the listing fee of the two most expensive system, and so on. If you have any questions, please reach out to firstname.lastname@example.org
The standard is maintained by the CCSS Steering Committee. The committee's mission is to ensure the standard continues to remain up-to-date with industry best practices and remain neutral. Current CCSS Steering Committee members are (in alphabetical order): S. Dirk Anderson, Andreas M. Antonopoulos, Petri Basson, Noah Buxton, Jameson Lopp, Joshua McDougall, Michael Perklin, and Ron Stoner.
COO at SALT Blockchain Inc.
Founder - HASH consulting, CCSS Committee Chair
Partner at The Network Firm
Senior Security Consultant at Confide
Founder and CTO - Casa
President, Slow Ninja
Chairman of the Board, CryptoCurrency Certification Consortium (C4)
Head of Security at CASA