CCSS™

Our CCSS™ Auditor and Implementer Training is Now available!

Learn more about the CCSS™ and how to get your system(s) certified.

What is the CCSS™?

CCSS is the security standard for cryptocurrency systems.

The CryptoCurrency Security Standard (CCSS) is a set of security requirements for information systems that store, manage, or interact with cryptocurrencies, including exchanges, custodians, wallet providers, and other digital asset systems. By providing a consistent security benchmark, CCSS helps organizations assess, improve, and demonstrate the security of their cryptocurrency systems. CCSS is updated regularly to reflect changes in the cryptocurrency ecosystem and emerging security practices. The current version is 9.0.

CCSS complements established information security standards, such as ISO/IEC 27001, by adding security requirements specific to cryptocurrency systems. It is not intended to replace broader information security standards, but to build on them. Like any security standard, CCSS should be implemented and assessed by qualified security professionals and auditors to help ensure risks are identified and addressed appropriately.

CCSS certification applies to systems, not entities. Systems can be certified at CCSS Level 1, 2, or 3, with each level building on the requirements of the previous one.

What types of systems can be CCSS Certified?

There are different types of cryptocurrency systems, and an Entity can have multiple types of systems. Entities are not certified, but rather systems are certified. Systems can be certified as CCSS Level 1, 2, or 3 with increased security as the levels increase. Systems fall into 3 buckets. Self-Custody, Qualified Service Provider (QSP), and Full System.

A self-custody system has sole control of the private keys that controls that entity’s own funds. Self Custody systems do not have control over customer funds.

A CCSS Qualified Service Provider (QSP)’s system meets many of the requirements for CCSS certification with the exception of the few requirements that another system has control over. A QSP is a system that facilitates a subset of custody services to other systems and therefore is only required to meet certain requirements. This means that if a system uses a QSP, the audit focus is only on the few remaining requirements to become certified.

A CCSS Full System is a system that meets all applicable CCSS requirements in totality. In situations where a system includes a QSP system as part of their system, some CCSS requirements may be met by the QSP system, as determined by the Cryptocurrency Security Standard Auditor (CCSSA).

Entities With Certified Systems

Documentation

CCSS Version 9.0

The lastest version of the Standard.

Auditor Guide

Guidance for conducting CCSS audits and peer review.

Glossary

Definitions of terms used throughout the CCSS.

Appendix 1 – Audit Agreement

Agreement defining the roles and responsibilities of the auditor, peer reviewer, and audited entity during the CCSS audit process.

CCSS Version 8.1

Past version of the CCSS.

Find a CCSS Certified System

How to start a CCSS Audit

Certified CCSS Systems have been independently evaluated and audited against 41 aspect controls of the CryptoCurrency Security Standard. Systems that earn Level 1, Level 2, or Level 3 designations have proven they are robust, resilient, and rooted in best practices. Learn more about the CCSS and how to get your system(s) certified below.

Implementing the CCSS

Before an audit takes place, entities may engage a CCSS Implementer to help design, build, and document controls in alignment with the Standard. Implementers work with the entity to assess the current state of the system, identify gaps against CCSS™ requirements, design appropriate control approaches, and produce the policies, procedures, diagrams, and evidence needed to support an audit.

Entities can find Certified CCSS Implementers on our website and contract directly with the Implementer of their choosing. Implementers are independent professionals who have demonstrated practical knowledge of how to apply the CCSS in real-world systems and have passed our CCSSI exam. While CryptoCurrency Certification Consortium (C4) certifies Implementers, it does not endorse or recommend specific individuals. Entities are responsible for following best practices when selecting and engaging an Implementer.

Auditing and Certification

The first step to getting audited is to select a CCSSA. You can search our currently certified CCSSAs here. Entities then contact and negotiate with the CCSSA of their choosing. Please note that while these individuals have proven their knowledge of the CCSS, C4 does not endorse specific CCSSAs. It is imperative that entities follow best practices for selecting an auditor.

All CCSS audits cover a period of time prior to audit completion and will test the operating effectiveness of the control over this period of time. Audits are designed to be performed at least annually and cover the preceding 12 month period. All audits performed by CCSSAs are reviewed by a CCSSA-Peer Reviewer before C4 certifies an entity. Any dispute arising out of the peer review process shall be arbitrated by the CCSS Steering Committee.

The CCSSA is responsible for ensuring all data related to the audit is transmitted and stored in a secure manner for the duration of the Certificate of Compliance (CoC) and as legally required in the jurisdiction of the audit. C4 will not view documentation of evidence outside the Summary Report on Compliance (SRoC). The CCSS steering committee shall review evidentiary documentation in the case of a peer review dispute.

*Text version of this image can be found in the Auditor’s Guide.

What is a CryptoCurrency Security Standard Implementer (CCSSI)?

A CryptoCurrency Security Standard Implementer is an expert in applying the CCSS in real-world systems. CCSSIs help entities design, implement, and document security controls in alignment with the CryptoCurrency Security Standard, preparing systems to meet Level 1, Level 2, or Level 3 requirements.

CCSSIs work directly with entities to help identify the likely audit scope, assess gaps against CCSS requirements, and produce the practical artifacts needed to support an audit, such as policies, procedures, and diagrams. CCSSIs do not perform audits and do not issue grades or certifications.

CCSSIs must avoid any potential conflict of interest. This may include current or previous employment, familial relationships, financial interest (such as tokens or equity held), or any other matters that may constitute a conflict of interest.

Learn how to become a CCSSI here.

What is a CryptoCurrency Security Standard Auditor (CCSSA)?

A CryptoCurrency Security Standard Auditor is an expert in the CCSS. CCSSAs are able to apply the CCSS standard to any information system that uses cryptocurrencies, calculating a grade for the system according to the CCSS.

CCSSAs must avoid any potential conflict of interest. This may include current or previous employment, familial relationships, financial interest (such as tokens or equity held), or any other matters that may constitute a conflict of interest.

Learn how to become a CCSSA here.

What is the cost of a CCSS Implementation?

Implementation fees will be determined between the CCSSI and the entity. It is the responsibility of the CCSSI to ensure sufficient time to complete the implementation is reflected in the agreed upon fees.

What is the cost of a CCSS audit?

Audit fees will be determined between the CCSSA and the entity. It is the responsibility of the CCSSA to ensure sufficient time to complete the audit is reflected in the agreed upon fees.

Audit fees must also include the Listing Fee and the CCSSA-PR’s fee, as determined between the CCSSA and the CCSSA-PR. The CCSSA-PR’s fee will be forwarded to the CCSSA-PR by the CCSSA. C4 will send an invoice for the Listing Fee to the CCSSA after approving the SRoC.

The listing fee, paid by the audited system’s entity to the CCSSA, is based on Table 1.

Who manages the CCSS?

The standard is maintained by the CCSS Steering Committee. The committee’s mission is to ensure the standard continues to remain up-to-date with industry best practices and remain neutral. Current CCSS Steering Committee members are (in alphabetical order):

Charné van Heerden

Head of Audit at Provenance

Charné Van Heerden is the Head of Audit at Provenance, a Certified Internal Auditor (CIA), and a Cryptocurrency Security Standard (CCSS) Auditor and advocate. She leads internal audit engagements across the crypto asset industry with a strong focus on governance, risk management, internal controls, and operational resilience. She emphasizes that strong controls and effective risk management should support operational efficiency and long-term sustainability. Charné actively promotes adoption of the CCSS as a cornerstone for secure custody and key management practices. She also serves on the Institute of Internal Auditors (IIA) Global Content Advisory Group (GCAG), where she contributes to advancing global audit practices and aims to educate auditors on the nuances and critical importance of crypto asset security and compliance. Before moving into the crypto space, Charné worked in risk-based internal auditing across multiple industries. At Provenance, she focuses on applying established assurance principles to emerging technologies, helping organizations implement resilient and sustainable control environments that meet regulatory and industry expectations.

Jameson Lopp

Co-Founder and Chief Security Officer of Casa

Jameson has been building multisig Bitcoin wallets since 2015. He is the co-founder and Chief Security Officer of Casa and also founded Mensa’s Bitcoin Special Interest Group, the Triangle Bitcoin & Business meetup, and several open source Bitcoin projects. He enjoys researching various aspects of the ecosystem and giving presentations about what he has learned the hard way while trying to write robust software that can withstand both adversaries and unsophisticated users.

Joshua McDougall

President, Slow Ninja

Researcher and Educator. Currently building games in the Cosmos for the sentient.

Marc Krisjanous

Founder and Principal Consultant at Zanarc

Marc is a CryptoCurrency Security Standard (CCSS) Auditor, Certified Bitcoin Professional (CBP), Certified Ethereum Professional (CEP), NORS Qualified Readiness Assessor, and ISO/IEC 27001 Lead Auditor. An active crypto/blockchain community member, Marc has authored numerous articles and books and volunteers his time for several associations, councils, and committees. Marc conducted the first CCSS audit certifying Fireblocks as the first QSP CCSS Level 3.

Michael Perklin

Security Expert and Chairman of the Board, CryptoCurrency Certification Consortium (C4)

Michael Perklin is an information security professional who has been working with bitcoin, blockchains, and decentralized systems since 2010. He has provided numerous contributions to the industry including founding the CryptoCurrency Certification Consortium (C4), securing the launch of Ethereum’s ICO, providing expert witness testimony to put cybercriminals behind bars, and drafting the CryptoCurrency Security Standard (CCSS). Michael has served on the boards of the Bitcoin Alliance of Canada and The Bitcoin Foundation, and was the Chief Information Security Officer of ShapeShift for five years before helping them decentralize into a DAO in 2021. Michael currently spends his time contributing to various decentralized projects as a security advisor and angel investor.

Ron Stoner

Head of Security at Botanix Labs

S. Dirk Anderson

Founder & Chief Strategist at Imagine Crypto, LLC, CCSS Steering Committee Chair

Dirk has worked with information security, privacy, and cryptography for a couple of decades so it was just natural that he would wind up in the world of crypto currencies and blockchains. Previously President and COO at SALT Blockchain, Dirk is currently Founder & Chief Strategist at Imagine Crypto, LLC Before SALT he spent a decade or so helping to build Coalfire, now the largest global dedicated cybersecurity consultancy where he held positions as the VP of Enterprise Risk & Compliance, VP of Threat Intelligence, and Regional VP of Professional Services for the Central US. Prior to all that he was a founder and Principle Analyst at Leviathan Security, served as the Chief Security Architect for ConQwest (now Towerwall), and as the Senior Manager of Global Security Architecture at Global Crossing, Ltd. His experience extends through a variety of industry verticals including retail, banking, telecommunications, investment, energy, higher education, government organizations, and third-party service providers such as hosting and cloud services. Dirk also teaches and speaks globally on the topics he’s passionate about contributing to the Certified Bitcoin Professional (CBP) training course on Udemy and Thinkific, teaching multiple session at the Blockchain Training Conference, and the Rocky Mountain Internet Security Conference, as well as sitting on panels at events including the London Blockchain Summit and Belgrade Venture Forum. He is also a contributing author to publications from the original SANS Incident Handling Step-by-Step guide to Security 2020: Reduce Security Risks This Decade. At C4 he serves on both the CBP and CCSSA committees.