How It Works
Earn your credential. Verify the trust.
Five steps, from a free Trust Check to a Trust Badge someone else can check. The Trust Check does not issue a credential.
The pathway
How a business earns a Trust Badge
Five steps. The free Trust Check comes first, and it does not issue a credential.
Step 1
See where you stand
Start with the free 2-Minute Business Trust Check. You get a snapshot from what you reported. It does not issue a Trust Badge.
Step 2
Do the readiness work
Work through scenario-based modules—about as long as a CPR class each—organized around the NIST Cybersecurity Framework so everyday decisions map to Identify, Protect, Detect, Respond, Recover, and Govern. Legacy Core is not affiliated with or endorsed by NIST. A technician can help with implementation; Legacy Core verifies the completed pathway before issuing your badge.
Step 3
Legacy Core reviews it
We review what you submitted against the Bronze standard. Paying starts the pathway. It does not issue the badge.
Step 4
You get a page someone can check
If the Bronze requirements are met, the business receives a Trust Badge and a listing in the Public Business Trust Registry.
Step 5
Keep it current
The listing stays up while the credential is in good standing. Silver and Gold come later. They need documented evidence, and they cannot be bought or self-declared.
Six chapters · scenario-based
Learn cybersecurity the way you’d learn CPR—one real scene at a time.
The Legacy Protection Journey groups the credentialing pathway into six subject names small-business owners actually use—not jargon-first module numbers. Each chapter is scenario-based modules, about as long as a CPR class, built around everyday decisions.
The six owner-friendly chapters below are organized around all six NIST CSF 2.0 functions—Govern, Identify, Protect, Detect, Respond, and Recover—so plain-language scenes still line up with a framework others recognize.
Scenario-based modules, about as long as a CPR class.
Legacy Core is not affiliated with or endorsed by NIST.
Chapter 1 · CSF 2.0: Govern · Identify
Know What You Protect
Who owns the security call at your firm—and what client data, systems, and obligations would hurt most if they leaked? Start with that honest picture.
Chapter 2 · CSF 2.0: Protect
Lock the Doors
Shared passwords, open Wi-Fi, and “just this once” exceptions are where outsiders walk in. Lock access, networks, and cloud accounts before you buy another gadget.
Chapter 3 · CSF 2.0: Detect · Protect
Spot the Threat
The urgent email. The fake vendor. The attachment that looks fine. Learn to spot social engineering and early malware signs before one click spreads.
Chapter 4 · CSF 2.0: Identify · Protect · Govern
Protect Customers & Money
When money or client records are on the line, sloppy handling becomes a headline. Walk payment, privacy, and insurance conversations like an owner—not a guesser.
Chapter 5 · CSF 2.0: Respond · Recover · Detect
Survive the Bad Day
Monday-morning ransomware is a business problem, not an IT trivia question. Practice who you call, what you freeze, and how you get back to work.
Chapter 6 · CSF 2.0: Govern · Identify · Protect · Detect · Respond · Recover
Prove & Strengthen
Vendors, frameworks, and new AI tools can help—or widen the blast radius. Tie the habits together and leave with a working protection plan.
Who does what
Legacy Core creates the trust signal. Partners implement security.
Implementation providers help businesses improve. Legacy Core determines whether the credential has been earned. Partners do not award the badge.
- 1
Business
Understands readiness, completes the credentialing pathway, implements improvements where needed, and supplies required information and evidence.
- 2
Legacy Core
Maintains the credentialing pathway and credential standard, reviews the application, determines credential status, and issues the Trust Badge when requirements are met.
- 3
Alliance Partners and qualified providers
Businesses may choose qualified implementation providers freely. Silver and Gold implementation evidence must be submitted through a verified, approved Alliance Partner company assigned to the business. An authorized Legacy Core human reviewer must accept the evidence and approve the credential. Partners cannot award credentials. Partner attestation is not independent review.
- 4
Customers and credential readers
Use the Public Business Trust Registry to check status and understand the recorded scope. Each customer or organization decides whether it meets their needs.
Implementation is separate from credentialing. See Alliance Partners · Governance · Discuss an evidence-review role
Implementation is separate from credentialing. Alliance Partners may implement security. They cannot purchase, guarantee, or self-award a Trust Badge.
Frequently asked questions
Do I need the Trust Check first?
You can pursue Bronze credentialing directly, but the 2-Minute Business Trust Check is the recommended starting point. It is diagnostic only. It does not issue a credential.
What happens after I earn Bronze?
Credentialed businesses appear in the Public Business Trust Registry. They may work with Alliance Partners and other trusted professionals as cybersecurity maturity grows. Partners may implement security. Legacy Core determines whether a higher credential has been earned.
How long does the credentialing pathway take?
Scenario-based modules run about as long as a CPR class each, at your pace. Many businesses finish Bronze in a few weeks overall. There is no fixed deadline.
How does the pathway relate to NIST?
The Legacy Protection Journey is organized around the NIST Cybersecurity Framework (CSF 2.0) so owners learn through scenes mapped to functions like Identify, Protect, Detect, Respond, Recover, and Govern. Legacy Core is not affiliated with or endorsed by NIST. Completing the pathway does not mean NIST reviewed or approved your business.
What happens if more work is needed before a credential is issued?
Legacy Core will tell you that the credential is not ready to issue yet. You can continue the pathway and come back when the business meets the applicable credential standard.
How is this different from a class?
Legacy Core issues credentials. It does not run a class. The pathway ends in a Trust Badge and a live registry listing.
How do I earn Silver or Gold?
Silver and Gold cannot be earned through self-attestation. Silver and Gold implementation evidence must be submitted through a verified, approved Alliance Partner company assigned to the business. An authorized Legacy Core human reviewer must accept the evidence and approve the credential. Partners cannot award credentials. Payment, a referral relationship, or Alliance Partner membership does not guarantee approval. Contact us for registry renewal details.
What appears in the public registry?
Credential information a customer or partner needs to verify status: business name, tier, credential status, area served, and related public dates when shown. Owner contact information, payment data, uploaded evidence, internal notes, and review history are never displayed publicly.
What if I let my credential lapse?
A lapsed credential shifts to Expired status in the registry. Verification pages continue to load, but the badge is no longer valid. You can renew to return to good standing.
See the pathway from the inside.
Start with the free Trust Check, or begin Bronze credentialing when you are ready. Silver and Gold cannot be earned through self-attestation.