Business Certification
Confidential computing certification for organizations
A CCSI certification shows that your organization’s protections for data in use are designed, implemented, and operated to a defined standard. Certificates are issued by CCSI after an evidence-based assessment.
Certification tiers
Tier 1
Foundation
For organizations starting to process sensitive data in trusted execution environments. Confirms that workloads run in a genuine TEE, that attestation evidence is collected, and that a documented key management design exists.
- Documented TEE architecture
- Attestation evidence collected and retained
- Baseline key management and access policy
Pricing: Contact us
Tier 2
Verified
For organizations that make decisions based on attestation. Confirms that secrets are released only to verified measurements and that sealed data and builds are controlled.
- Attestation-gated key release
- Measurement allow-lists under change control
- Sealed-data lifecycle and rotation
- Signed, traceable builds
Pricing: Contact us
Tier 3
Assured
For organizations whose customers or regulators rely on their confidential computing claims. Adds reproducible builds, independent verifiability, and tested incident response.
- Reproducible builds and published measurements
- Customer-verifiable attestation
- TEE vulnerability and TCB-recovery process
- Annual reassessment
Pricing: Contact us
What is assessed
Trusted execution environments
Choice and configuration of TEEs (for example Intel SGX/TDX, AMD SEV-SNP, Arm CCA, AWS Nitro Enclaves, confidential VMs and containers), isolation boundaries, debug modes, and side-channel mitigations.
Remote attestation
How evidence is produced, transported, and verified; verifier placement; freshness and replay protection; certificate chains and collateral; and policy for what measurements are trusted.
Key management
Key hierarchy, attestation-bound key release, KMS and HSM integration, separation of duties, rotation, and revocation when a TCB is compromised.
Sealed data
Sealing policies, binding to measurements or signers, migration and upgrade paths, backup, and safe destruction.
Supply chain
Build provenance, reproducibility, dependency control, image signing, firmware and microcode tracking, and timely response to TEE and platform advisories.
How certification works
- 01
Scoping call and tier selection
- 02
Evidence submission and architecture review
- 03
Technical verification of attestation and key release
- 04
Report, remediation window, and certificate issued by CCSI