Blockchain Security Standards: CCSS, SOC 2, ISO 27001, NIST

By the Guardian team Updated November 2026 6 min read

Quick answer. Start with four: SOC 2 (a CPA's report on controls), ISO 27001 (a certified management system), NIST CSF 2.0 (an outcomes framework) and CCSS (certifies a crypto system's key management). BSSC and SEAL add crypto-native standards.

Watch: Blockchain Security Standards: CCSS, SOC 2, ISO 27001, NIST 1:48

Video transcript

A bank that diligences you will ask which security standards you meet, and for the report or certificate behind each answer.

General frameworks fit any organization. Wallets, multisigs and smart contracts need specific rules, so crypto-native standards stack on top.

SOC 2 is a CPA's report, not a certification. ISO 27001 certifies a management system, and NIST CSF 2.0 sets outcomes with no certificate. CCSS certifies one system's keys, and BSSC and SEAL add crypto-native standards.

June 2023 interagency guidance says banks may consider reviewing SOC reports and certifications, and whether their scope fits the activity. Be ready with your SOC 2 period, ISO certificate expiry, CCSS level and NIST profiles.

Everyone should map to NIST CSF 2.0, which is free. Add a SOC 2 Type 2 for banks, ISO 27001 for certificate buyers, and CCSS where you hold client keys. Protocols add audited contracts and SEAL.

Aligned is not certified. Guardian's own site lists NIST CSF 2.0 and CCSS as aligned, and its SOC 2 Type 2 as underway.

Guardian's Cybersecurity Maturity Assessment scores your program from evidence, not interviews, assessing the 93 ISO 27001 Annex A controls and leveling key management against CCSS.

The report or certificate itself comes from a CPA firm, certification body or CCSS auditor. Read the full guide, or talk to Guardian about mapping your program.

A bank or allocator that diligences you will ask which security standards you meet. It will also ask for the report or certificate behind each answer.

This guide compares six: what each covers, who attests, how long it takes and what institutions ask for.

Why Crypto Needs Its Own

The general frameworks are written for any organization. NIST says CSF 2.0 "does not prescribe how outcomes should be achieved."

Wallets, multisigs and smart contracts need more specific rules, from key generation to key compromise. The crypto-native standards supply them.

They stack rather than compete. C4 says CCSS "complements broader frameworks such as ISO 27001 rather than replacing them."

BSSC's general guidelines are organized by NIST CSF. In some cases they defer to ISO 27001, SOC 2 or CCSS.

The General Frameworks

SOC 2

SOC 2 is an attestation under AICPA standards. A licensed CPA examines controls relevant to security, availability, processing integrity, confidentiality or privacy.

"SOC 2 is not a certification," says Amy Pawlicki, the AICPA's vice president for assurance and advisory innovation. The result is a report.

A 2016 Journal of Accountancy article, now in its archive, sets out the report types:

Type 1: the design of controls, as of a specified date.
Type 2: adds an opinion on whether they operated effectively throughout a specified period.
Use: SOC 2 reports are generally restricted; SOC 3 reports are not.

Pawlicki says the work should be done annually, because things can change over time.

Check the CPA firm and the timeline. In May 2026 the AICPA's Peer Review Board asked peer reviewers to probe "the reasonableness of SOC 2 engagement timelines."

ISO/IEC 27001

BSI calls ISO/IEC 27001 "the global information security management system (ISMS) standard." Certification bodies certify an organization's ISMS against it.

BSI, one such body, runs a two-stage audit. It describes its management system certificates as valid for three years, with surveillance audits at least once a year and recertification at the end.

NIST CSF 2.0

NIST published CSF 2.0 on February 26, 2024. It offers a taxonomy of high-level security outcomes for any organization, "regardless of its size, sector, or maturity."

Its six functions are Govern, Identify, Protect, Detect, Respond and Recover. You describe a current and a target profile against them.

There is no certificate. NIST "does not offer certifications or endorsements" of CSF implementations, and has no plans for a conformity assessment program.

The Crypto-Native Standards

CCSS

The CryptoCurrency Security Standard comes from the CryptoCurrency Certification Consortium (C4). It certifies systems, not entire companies, at Level 1, 2 or 3.

Version 9 has ten aspects in two groups:

Cryptographic asset management: key and wallet generation, key storage, access and usage, data sanitization.
Operations: security tests and audits, logging and monitoring, governance and risk, key compromise.

Level 1 already requires an external audit of every smart contract version in production, with Medium and higher issues addressed before deployment.

A CCSS Auditor runs the audit. An independent peer reviewer checks it before a Certificate of Compliance is issued.

C4 says audits are typically annual and assess the preceding 12 months.

BSSC

The Blockchain Security Standards Council is a nonprofit consortium. Its members include Coinbase, Kraken, Anchorage Digital, BitGo and Fireblocks.

It lists six standards: node operation, token integration, key management, general security and privacy, smart contracts, and the transaction lifecycle.

Its frameworks "allow third party auditors to verify" that best practices are followed. Its site describes no certification.

Version 2 of its Smart Contract Security Standard, with a new audit framework, came out on November 2, 2026.

SEAL Certifications

The Security Alliance (SEAL), which describes itself as a crypto ISAC, opened SEAL Certifications for business on June 2, 2026.

The program covers six operational domains:

Multisig operations.
Treasury operations.
Incident response.
DNS and registrar.
DevOps and infrastructure.
Identity and accounts.

Accredited audit firms assess an agreed scope as a single pass or fail. Protocols that pass get an onchain attestation.

SEAL puts a typical engagement at a few weeks from scoping to certification.

Side by Side

Standard	Owner	Covers	Who attests	Result and timing
SOC 2	AICPA	Controls for security, availability, integrity, confidentiality or privacy	A licensed CPA	Type 1 or Type 2 report; repeat annually
ISO/IEC 27001	ISO and IEC	An information security management system	A certification body	Certificate; three years, yearly surveillance (BSI)
NIST CSF 2.0	NIST	Security outcomes in six functions	No one; NIST offers no certification	Current and target profiles
CCSS	C4	One system's keys and operations	CCSS Auditor, then peer review	Level 1, 2 or 3; typically annual
BSSC standards	BSSC	Nodes, tokens, keys, contracts, transactions, general security	Third-party auditors, using its audit frameworks	No certification program listed
SEAL Certifications	Security Alliance	Protocol operations in six domains	Accredited audit firms	Onchain attestation; a few weeks

What Institutions Ask For

The Federal Reserve, FDIC and OCC issued final interagency guidance on third-party risk in June 2023. It says a bank "may consider reviewing" SOC reports and independent certifications against domestic or international standards.

Its examples of standard setters are NIST, Accredited Standards Committee X9 and ISO.

The bank may also consider whether "the scope and the results" are relevant to the activity. A SOC 2 that leaves out your signing service says little about your keys.

Be ready to answer:

SOC 2: Type 1 or Type 2, which period, which systems, any exceptions.
ISO 27001: the certificate's scope, issuer and expiry.
CCSS: which system is certified, and at what level.
NIST CSF: current and target profiles, with evidence.

For the full set of requests, see institutional security requirements for onchain teams and our vendor due diligence questionnaire.

Which to Pursue

Start from who you sell to and what you hold.

Everyone: map your controls to NIST CSF 2.0. It is free, and BSSC's guidelines use its structure.
Selling to banks and enterprises: a SOC 2 Type 2, renewed yearly.
Buyers who want a certificate: ISO 27001, on its three-year cycle.
Holding client keys: CCSS on the system that holds them.
Protocol teams: audited contracts, plus SEAL modules for multisig, treasury and incident response.

State your status exactly. "Aligned" is not "certified", and NIST offers no CSF certification.

For key handling in depth, see our guide to private key management.

How Guardian Helps

Guardian's Cybersecurity Maturity Assessment, part of its Regulatory & Compliance service, scores your program against NIST CSF 2.0, ISO 27001 and CCSS from evidence, not interviews.

You get a current and target CSF profile, the 93 ISO 27001 Annex A controls assessed for design and operation, and key management leveled against CCSS.

The Digital Asset Assurance Pilot maps CCSS levels, ISO 27001 and NIST CSF onto your actual key ceremony and change control.

Guardian holds itself to the same bar. Its site lists NIST CSF 2.0 and CCSS as aligned, and its SOC 2 Type II as underway, with an auditor engaged.

The certificate or report itself comes from a CCSS auditor, a CPA firm or a certification body.

Frequently Asked Questions

Is SOC 2 a certification?

No. The AICPA's Amy Pawlicki calls it "an examination-level attestation engagement signed off on by a licensed CPA." The result is a Type 1 report on control design, or a Type 2 that adds operating effectiveness over a period.

Can a company be NIST CSF certified?

Not by NIST. NIST "does not offer certifications or endorsements" of CSF implementations and has no plans for a conformity assessment program. A company can show alignment through current and target profiles, backed by evidence.

What is the difference between CCSS and ISO 27001?

An ISO 27001 certificate covers an organization's information security management system. A CCSS certificate covers one cryptocurrency system's key management and operations, at Level 1, 2 or 3. C4 says CCSS complements ISO 27001 rather than replacing it.

Which security standards do banks ask crypto vendors for?

US interagency guidance says banks may consider reviewing SOC reports and independent certifications against standards such as NIST's and ISO's, and whether their scope is relevant to the activity. CCSS covers the key handling those general frameworks leave open.

Sources

Map your program to the standards

Guardian scores your controls against NIST CSF 2.0, ISO 27001 and CCSS from evidence, then maps them onto how your keys and code actually run.

Talk to Guardian Explore the assurance pilot