Turn assessment results into a trust signal
NS-CTAF certification turns internal software assurance into an external trust signal — four levels, an independent review, and a public, verifiable certificate.
CTA-1 Transparent to CTA-4 Adaptive Trust
Levels are earned by Trust Score and minimum domain maturity thresholds — and every level must clear the hard gates.
Transparent
45+ controls
The software supply chain is visible. SBOMs, basic scanning, dependency inventory, and ownership are in place.
- L2 maturity in D1, D4, and D6
- Automated SBOM generation
- Basic identity & governance controls
Verified
63+ controls
Trust is backed by cryptographic evidence — artifact signing, build provenance, and automated security controls.
- L3 maturity in D1–D3
- Artifact signing & SLSA Build L2
- SAST gate and threat modelling in place
Assured
78+ controls
Trust is continuously measured across development, supply chain, runtime, and governance.
- L3.5+ maturity across all domains
- SLSA Build L3 and CVE patch SLAs
- Runtime anomaly detection operating
Adaptive Trust
86 / 86 controls
Trust is automated, continuously computed, self-healing, and independently verified.
- L4+ maturity across all domains
- SLSA Build L4 and reproducible builds
- Trust API and continuous re-certification
Seven hard gates. 7 foundational requirements must pass before any CTA level is awarded — regardless of the overall Trust Score. They cannot be compensated for by strength in other areas.
From application to renewal
Certification is a lifecycle, not a one-off — with annual renewal and, for higher levels, quarterly verification.
Application and commercial onboarding
Assessment scoping and evidence request
Evidence submission through the portal
Assessment and scoring
Independent review and certification decision
Certificate issue and registry listing
Annual renewal and, for higher levels, quarterly verification
Suspension or withdrawal if conditions degrade
Status the market can rely on
Every certificate carries a public status. Basic verification is always free; deeper access is available through Report Access.
Active
Certificate is valid and current.
Expiring Soon
Expires within the notification period (e.g. 60 days).
Expired
Certificate validity has ended.
Suspended
Temporarily paused pending review.
Withdrawn
Certification has been removed.
Superseded
Replaced by a newer certificate or assessment.
Earn a trust signal your customers can verify.
Fixed fee $5,000 USD · ~20 business days · Final report, CTA certificate, and improvement roadmap.