Trust should be verifiable.

A small business cybersecurity credential is a verifiable Trust Badge issued by Legacy Core after review, with live verification in the Public Business Trust Registry. The free Trust Check is a diagnostic Readiness Assessment and does not issue a badge. Bronze is earned after the credentialing pathway, Bronze requirements, and Legacy Core approval. It does not mean every technical control was tested. Silver and Gold require documented evidence and cannot be self-attested. The pathway is aligned with NIST CSF 2.0 and CIS Controls v8. Legacy Core is not affiliated with, endorsed by, or accredited by NIST, CIS, or any government agency.

A Trust Badge is a verifiable credential issued by Legacy Core after pathway review. Each badge links to a live registry listing anyone can check at legacycore.com/verify. Bronze is Baseline Readiness. Silver is Evidence-Verified Implementation. Gold is Ongoing Verified Readiness, not continuous technical monitoring. Silver and Gold cannot be self-attested.

The Trust Gap is the distance between how seriously a business takes data protection and what its clients can actually verify. Read the full definition.

Start with a free Trust Check to understand your Trust Gap. When you are ready, complete the credentialing pathway and Legacy Core review, then list your business in the Public Business Trust Registry. Share your verification URL or credential ID so clients can confirm status themselves.

A credential is a reviewed, verifiable Trust Badge with a live registry listing Legacy Core issues after pathway review. ISO/IEC 27001 certification, SOC 2 examinations, PCI DSS and CMMC are separate programs. Legacy Core covers them as awareness topics only, and they are not Legacy Core credential requirements. Legacy Core is aligned with NIST CSF 2.0 + CIS Controls v8. It does not claim to be those frameworks or legal compliance.

Use the Public Business Trust Registry at legacycore.com/verify. Search by business name or enter a credential ID from a Trust Badge. A verified listing shows stored tier, status, dates, and standard version when recorded. Public verification checks credential status and recorded assessment scope. It does not prove a business is currently free of security weaknesses.

No. Legacy Core does not require businesses to purchase cybersecurity implementation services or a specific security product to earn a credential. You may work with qualified providers of your choice, including Alliance Partners. Providers may support readiness. Legacy Core determines whether the credential requirements have been met.

No. Legacy Core issues reviewed Trust Credentials. It reviews readiness and issues Trust Badges. Alliance Partners and other providers implement security. The Public Business Trust Registry lets third parties check credential status. Legacy Core is not an MSP, MSSP, monitoring platform, or vulnerability scanner.

The business supplies readiness information. Silver and Gold implementation evidence must be submitted through a verified, approved Alliance Partner company assigned to the business. An authorized Legacy Core human reviewer must accept the evidence and approve the credential. Partners cannot award credentials. The Trust Council is in formation and has not approved the current Standards Release. Public verification then shows status and recorded assessment scope.

Legacy Core's credentialing pathway is aligned with NIST CSF 2.0 and CIS Controls v8. Our readiness education also uses CIS Controls Implementation Group 1 (IG1), CISA's Cross-Sector Cybersecurity Performance Goals and the FTC's Cybersecurity for Small Business guidance as educational references. Our educational materials also address CCPA/CPRA awareness. These references support readiness education; a Legacy Core credential does not certify regulatory compliance, completion of a required cybersecurity audit or implementation of every referenced safeguard. Legacy Core is not affiliated with, endorsed by, or accredited by NIST, CIS, or any government agency.

It depends. Whether a business must complete a CCPA cybersecurity audit depends on the criteria in California's regulation (Cal. Code Regs. tit. 11, §7120), and first-audit deadlines are phased under §7121. Our educational materials also address CCPA/CPRA awareness. They are not an audit, and a Legacy Core credential does not show that a required audit was completed. Ask a qualified attorney whether the regulation applies to your business.