Aspects
1
Controls
2
Requirements
6
| Aspect ID | Aspect Name | Control ID | Control Name | Requirement ID | Requirement | Level |
|---|---|---|---|---|---|---|
| 2.01 | Security Tests/ Audits | 2.01.1 | Security Development and Documentation | 2.01.1.1 | An individual(s) with expertise in information security must be engaged in all stages of the design, development, deployment, and ongoing maintenance of systems providing cryptocurrency functions. | Level I |
| 2.01 | Security Tests/ Audits | 2.01.1 | Security Development and Documentation | 2.01.1.2 | A regular security assessment that includes vulnerability and penetration testing has been completed by an independent, qualified third-party. Documentation shows that all concerns raised by the assessment have been evaluated for risk and addressed by the entity. | Level II |
| 2.01 | Security Tests/ Audits | 2.01.1 | Security Development and Documentation | 2.01.1.3 | A regular security audit at a level similar to SOC 2, ISAE3402, or ISO/IEC 27001, that includes vulnerability, penetration testing, and code audit (if applicable) has been completed by an independent qualified third-party. Documentation shows that all concerns raised by the audit have been evaluated for risk, addressed by the entity, and known vulnerabilities have been removed from the CCSS Trusted Environment. Ongoing audits are scheduled on a (minimum) yearly basis. | Level III |
| 2.01 | Security Tests/ Audits | 2.01.2 | Smart Contract Software Code Audit Documentation | 2.01.2.1 | All smart contract software code versions deployed to the environment(s) where the entity stakeholders interact with the smart contract have been audited by an external third-party auditor skilled in the development languages used for the smart contract software. NOTE: the requirement is not applicable to any environments used for development, testing, or staging. This requirement applies to smart contracts deployed to the "production" network or the like. | Level I |
| 2.01 | Security Tests/ Audits | 2.01.2 | Smart Contract Software Code Audit Documentation | 2.01.2.2 | All smart contract software code audit reports are accessible to the entity stakeholders. The audit reports cover the currently deployed versions to the environment(s) where the entity stakeholders interact with the smart contract. NOTE: the requirement is not applicable to any environments used for development, testing, or staging. This requirement applies to smart contracts deployed to the "production" network or the like. | Level II |
| 2.01 | Security Tests/ Audits | 2.01.2 | Smart Contract Software Code Audit Documentation | 2.01.2.3 | All issues with a severity of medium or higher identified in a code audit of the smart contract software are addressed by the entity before deployment to the environment(s) where the entity stakeholders interact with the smart contract. NOTE: the requirement is not applicable to any environments used for development, testing, or staging. This requirement applies to smart contracts deployed to the "production" network or the like. | Level II |
Page 1 of 1