# CryptoCurrency Security Standard (CCSS) v9.0

Framework id: `ccss_v9`. Digital Asset Security. Publisher: CryptoCurrency Certification Consortium (C4). Version: 9.0 (2024). Region: Global. Mapping licence: CC BY-SA 4.0.
Source text: https://cryptoconsortium.org/standards-2/

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (47, average coverage 54%)
- 1.01.1 Key Material Generation — Confidentiality of Key Generation Environment: SC-28, PE-02, PE-03, PE-06, SC-12 (55%)
- 1.01.2 Key Material Generation — Entropy and Randomness Sources: SC-12, SC-13 (60%)
- 1.01.3 Key Material Generation — Software Validation and Integrity: SI-03, SI-07, CM-03, CM-05 (65%)
- 1.01.4 Key Material Generation — Automated Signing Agent Key Transfer: SC-12, SC-28, MP-05, SC-08 (45%)
- 1.01.5 Key Material Generation — Level 1 Documentation and Procedural Controls: SC-12, PL-01, CA-09 (50%)
- 1.01.6 Key Material Generation — Level 2 Generation Methodology Validation: CA-02, SC-12, SC-13 (50%)
- 1.01.7 Key Material Generation — Level 3 Advanced Ceremony Controls: SC-12, PE-02, PE-03, AU-10 (30%)
- 1.02.1 Wallet Creation — Single-Signer Wallet Architecture: SC-12, SC-13, CM-07 (45%)
- 1.02.2 Wallet Creation — Multi-Signer Wallet Architecture: SC-12, SC-13, AC-05 (40%)
- 1.02.3 Wallet Creation — Wallet Inventory and Address Management: CM-08, SC-12, PM-05 (50%)
- 1.02.4 Wallet Creation — Address Verification and Integrity: SI-07, SC-12, SC-17 (45%)
- 1.02.5 Wallet Creation — Level 2 Documented Custody Policy for Wallet Creation: PL-01, SC-12, PM-09 (55%)
- 1.02.6 Wallet Creation — Level 2 Deterministic Wallet Controls: SC-12, CM-03, CM-06 (35%)
- 1.02.7 Wallet Creation — Level 3 Smart Contract Wallet Auditing: CA-08, SA-11, SA-15 (30%)
- 1.02.8 Wallet Creation — Level 3 Smart Contract State Monitoring: SI-04, AU-06, IR-05 (30%)
- 1.03.1 Key Storage — Encryption of Keys at Rest: SC-28, SC-12, SC-13 (75%)
- 1.03.2 Key Storage — Backup Existence and Accessibility: CP-09, CP-10, SC-12 (70%)
- 1.03.3 Key Storage — Environmental Protection of Key Backups: PE-09, PE-10, PE-13, PE-14, CP-09 (70%)
- 1.03.4 Key Storage — Level 2 Geographic Separation of Key Backups: CP-06, CP-09, PE-18 (65%)
- 1.03.5 Key Storage — Level 2 Access Control for Key Material: AC-03, AC-06, AC-17, IA-02, IA-12 (70%)
- 1.03.6 Key Storage — Level 3 Cold Storage and Hardware Security Controls: SC-12, SC-28, PE-02, PE-03 (35%)
- 1.03.7 Key Storage — Level 3 EMP-Resistant Backup Storage: PE-09, PE-14, CP-09 (20%)
- 1.04.1 Key Material Access — Keyholder Onboarding and Access Grant Procedures: PS-04, AC-02, IA-02, IA-05 (65%)
- 1.04.2 Key Material Access — Keyholder Offboarding and Access Revocation: PS-04, PS-05, AC-02, IA-05 (70%)
- 1.04.3 Key Material Access — Level 2 Quorum-Based Keyholder Authorization: AC-05, AC-06, IA-02 (45%)
- 1.04.4 Key Material Access — Level 2 Keyholder Identity Verification and Training: PS-03, AT-03, IA-12 (65%)
- 1.04.5 Key Material Access — Level 3 Formal Keyholder Registry and Audit Trail: AU-09, AU-10, AU-12, CM-08 (50%)
- 1.05.1 Key Usage — Transaction Authorization and Signing Controls: AC-03, AC-06, IA-02, AU-10 (55%)
- 1.05.2 Key Usage — Key Usage Logging and Non-Repudiation: AU-02, AU-03, AU-09, AU-10, AU-12 (75%)
- 1.05.3 Key Usage — Level 2 Multi-Party Authorization for High-Value Transactions: AC-05, AC-06, IA-02 (45%)
- 1.05.4 Key Usage — Level 2 Destination Address Whitelisting and Verification: CM-07, AC-04, SI-03 (40%)
- 1.05.5 Key Usage — Level 3 Hardware-Enforced Signing and Trusted Display: SC-12, SC-28, PE-03 (25%)
- 1.06.1 Key Compromise Protocol — Documented Key Compromise Response Procedures: IR-01, IR-08, CP-02, SC-12 (60%)
- 1.06.2 Key Compromise Protocol — Compromised Keyholder Response and Access Revocation: IR-06, PS-04, AC-02, IA-05 (60%)
- 1.06.3 Key Compromise Protocol — Level 2 Tested and Rehearsed Response Procedures: IR-03, CP-04, IR-08 (60%)
- 1.06.4 Key Compromise Protocol — Level 3 Out-of-Band Communication and Advanced Compromise Controls: IR-08, CP-02, SC-08 (40%)
- 2.01.1 Security Audits — Level 1 Vulnerability Scans and Annual Security Review: CA-02, CA-07, RA-05, SI-02 (80%)
- 2.01.2 Security Audits — Level 2 Independent Penetration Testing: CA-08, RA-05, CA-02 (80%)
- 2.01.3 Security Audits — Level 3 Full Independent CCSS Compliance Audit: CA-02, CA-07, CA-08, AU-06 (65%)
- 2.02.1 Data Sanitization — Level 1 Documented Sanitization Policy for Key Material: MP-06, MP-07, SI-12 (80%)
- 2.02.2 Data Sanitization — Level 2 Verified Destruction with Evidence: MP-06, AU-10, CA-09 (70%)
- 2.02.3 Data Sanitization — Level 3 Third-Party Verified Destruction: MP-06, CA-02, AU-10 (55%)
- 2.03.1 Proof of Reserve — Level 1 Internal Reserve Verification and Reconciliation: CA-02, AU-06, AU-11 (30%)
- 2.03.2 Proof of Reserve — Level 2 Independent Third-Party Reserve Attestation: CA-02, CA-08, AU-06 (25%)
- 2.04.1 Audit Logs — Level 1 Logging Policy and Key Management Event Logging: AU-01, AU-02, AU-03, AU-09, AU-12 (80%)
- 2.04.2 Audit Logs — Level 2 Tamper-Evident Log Storage and Alert Generation: AU-09, AU-10, AU-06, SI-04, IR-06 (75%)
- 2.04.3 Audit Logs — Level 3 One-Year Retention, SIEM Integration, and Blockchain Event Monitoring: AU-11, AU-06, SI-04, AU-09 (65%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=ccss_v9
- Control-to-clause mappings as JSON: /api/v1/frameworks/ccss_v9?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/ccss-v9.json
- Page for people: /frameworks/ccss-v9/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.