Standards Summary
Release 2026.Q3
This page describes what Bronze, Silver, and Gold represent. It does not publish scoring, evidence-acceptance rules, or how a reviewer reaches a decision. The Trust Council is in formation. No Trust Council approval is claimed for this Standards Release. Legacy Core reviews submitted evidence against these published requirements. Qualified external reviewers may evaluate evidence when appointed. Those relationships are being established.
Related: Credential Integrity & Governance · Become a Verification Partner
Aligned with NIST CSF 2.0, CIS Controls v8
- Reviewed
- July 13, 2026
- Published
- July 13, 2026
- Standards version
- Standards Summary 2026.Q3, published July 13, 2026
Release summary
This Standards Summary describes what Legacy Core credentials represent as reviewed on July 13, 2026. The pathway is aligned with NIST Cybersecurity Framework 2.0 and CIS Controls v8. This cycle also monitors NIST IR 8374 Rev. 1 (final June 11, 2026) and California CCPA §7123(c) for future alignment review. Monitored frameworks are tracked only and are not part of the current credential standard. The public summary describes outcomes. It does not publish scoring, thresholds, or review procedures.
Framework alignment
Recognized sources the pathway is aligned with. Alignment is not endorsement or certification.
- View framework →
NIST Cybersecurity Framework(2.0)
NIST
- View framework →
CIS Controls(v8)
Center for Internet Security
Standards Summary: Release 2026.Q3
The published outcome standard each tier is verified against. Businesses are not expected to implement Silver and Gold alone. Alliance Partners may help implement security. Legacy Core determines whether the credential has been earned. Silver and Gold cannot be self-attested.
Silver: Evidence-Verified Implementation
S-IAIdentity and access
The business can show that access to accounts and systems is controlled, not merely claimed.
S-DPData protection
The business knows what client data it holds, where it lives, and how it is handled.
S-RSResilience
The business can show backup and recovery practices that go beyond storing files in the cloud.
S-SOSecurity operations
Device, email, and network protections appropriate to the business have been put in place.
What this means for medical & dental practices under HIPAA →
S-GVGovernance
Written practices, incident readiness, and team awareness support the credential. A verbal promise is not enough.
Gold: Ongoing Verified Readiness
Gold is issued after review of this pathway. Legacy Core does not continuously monitor credentialed businesses in-product.
G-OVOngoing visibility
Gold looks for continued awareness of systems and practices, not a one-time implementation snapshot.
G-DRDemonstrated recovery
Recovery and response have been shown to work in the business, not only written down.
G-MRMaintained readiness
Practices stay current. Gold is not issued on a stale implementation claim.
Implementation is separate from credentialing.
Verified, approved Alliance Partner companies assigned to the business submit Silver and Gold implementation evidence. A partner reviewing work it implemented is not an independent review. You do not have to buy that help from Legacy Core or a partner to qualify. Legacy Core determines whether the credential has been earned. Payment, a referral relationship, or Alliance Partner membership does not guarantee approval.
Silver and Gold cannot be earned through self-attestation. Qualified external reviewers may evaluate evidence when appointed for the relevant scope. Those relationships are being established.
Monitored
Frameworks tracked for future alignment review. Not part of the assessment basis.
- View framework →
NIST IR 8374 Rev. 1 — Ransomware Risk Management (CSF 2.0 Community Profile)(Rev. 1)
NIST
New this cycle. Final June 11, 2026, superseding the 2022 profile. Monitored for future alignment review.
- View framework →
California CCPA §7123(c)
State of California
18-control structure.
How we use framework references
Reference note. Not part of Release 2026.Q3.
Legacy Core's credentialing pathway is aligned with NIST CSF 2.0 and CIS Controls v8. Our readiness education also uses CIS Controls Implementation Group 1 (IG1), CISA's Cross-Sector Cybersecurity Performance Goals and the FTC's Cybersecurity for Small Business guidance as educational references. Our educational materials also address CCPA/CPRA awareness. These references support readiness education; a Legacy Core credential does not certify regulatory compliance, completion of a required cybersecurity audit or implementation of every referenced safeguard.
- NIST CSF 2.0 and CIS Controls v8: the published alignment for the credentialing pathway (see Framework alignment above). The pathway is organized around all six CSF functions: Govern, Identify, Protect, Detect, Respond and Recover.
- CIS Controls IG1 (educational reference): Implementation Group 1 is the foundational set of safeguards within CIS Controls v8. We use it as an educational reference for basic cyber hygiene. It does not change the published alignment above.
- CISA Cross-Sector Cybersecurity Performance Goals (educational reference): practical guidance on topics such as backups, detection, incident response, access and vendor practices.
- FTC Cybersecurity for Small Business (educational reference): plain-English guidance on topics like phishing, ransomware, email authentication, vendors and customer data. This is the FTC's educational guidance, not the FTC Safeguards Rule.
- CCPA/CPRA: Our educational materials also address CCPA/CPRA awareness. Whether a business must complete a CCPA cybersecurity audit depends on the criteria in Cal. Code Regs. tit. 11, §7120, with first-audit timing phased under §7121. We recommend review by a qualified attorney.
Three different lists of 18. California's regulation (§7123(c)) lists 18 components a cybersecurity audit must assess, where applicable. The CIS Critical Security Controls are a separate set of 18 Controls published by the Center for Internet Security. Legacy Core's free 18-area checklist is our own plain-language checklist. They are three different lists.
Awareness topics. ISO/IEC 27001, SOC 2, PCI DSS and CMMC appear in our materials as awareness topics only. They are not Legacy Core credential requirements, and a Legacy Core credential does not show that a business has implemented them or been assessed against them.
Legacy Core is not affiliated with, endorsed by, or accredited by NIST, CIS, or any government agency.