§Issuance rules

Rules for issuing and maintaining certificates

Version 2026.3 · effective 1 July 2026

1

Scope

  1. The scope — components, domains, environments and exclusions — is agreed in writing before testing begins.
  2. The scope cannot be narrowed after a finding. A company may withdraw an application; the withdrawal is not published.
  3. The scope and the exclusions are published on the Trust Page in full.
2

Blocking criteria

  1. A Critical risk blocks the issue of a certificate at every level until it is remediated and re-tested.
  2. A High risk must be remediated for levels V3 and V4. For V1 and V2 an open High is disclosed as a count on the Trust Page.
  3. Findings cannot be “accepted” by the company to obtain a certificate; risk acceptance applies only to Medium and below and is recorded.
3

Results and evidence

  1. Every check in the scope receives a recorded result: passed, confirmed, not applicable, failed or pending.
  2. Evidence for every result is stored by CyberSecurityV for the validity period plus twelve months.
  3. Trust Pages carry a public evidence summary only. Vulnerability details, secrets, private addresses, code fragments and any evidence that could facilitate an attack are never published.
4

Validity

  1. A certificate is valid for twelve months from the verification date and names the methodology edition it was verified against.
  2. Renewal is a full verification against the current edition.
5

Material changes and re-verification

  1. The company must report a material change within ten business days. Material changes include replacement of authentication or authorisation mechanisms, new components in scope, migration of hosting, a security incident affecting the scope and a High or Critical vulnerability reported by a third party.
  2. On a reported or discovered material change the certificate is suspended until the affected checks are re-verified.
  3. Re-checks under V4 monitoring that reveal a High or Critical risk suspend the certificate automatically.
6

Suspension and revocation

  1. Suspension is temporary. It is lifted after a successful re-check or converted to revocation if the risk is not remediated within the agreed deadline — thirty days for High, five business days for Critical.
  2. Revocation is final. Grounds: an unremediated Critical or High risk after the deadline, false information in the application, misuse of the certificate or badge, obstruction of a re-check, or non-payment.
  3. The status, the date of change and the reason are published on the Trust Page. Suspended, expired and revoked records remain in the registry.
7

Use of the certificate and badge

  1. The badge may be used only in the form issued and must link to the Trust Page.
  2. The certificate may not be presented as covering components outside the published scope, nor as an endorsement of the product or the company.
  3. Reference to CyberSecurityV in marketing must use the exact brand name and must not imply accreditation or partnership with any standards body.
8

Appeals

  1. A company may appeal a finding or a status decision in writing within ten business days. Appeals are reviewed by a person not involved in the original verification.
  2. The appeal, its outcome and the reasoning are recorded. Publication of the outcome is limited to the status change, if any.
9

Confidentiality and conflicts of interest

  1. CyberSecurityV does not develop, resell or integrate the products it verifies and does not receive payment contingent on the result.
  2. Private reports, accesses and evidence are used only for the verification and are deleted or revoked when it ends, except evidence retained under section 3.