GCSB Trustmark
GCSB Organisational Trustmark
Awarded to organisations whose converged security governance, risk, technology, identity, response, training, data protection, compliance and leadership arrangements have been independently assessed by the GCSB Assessment Board against the GCSB CSF Version 2.0 standards, at Bronze, Silver, Gold or Platinum tier.
Verified by GCSB
Apply for this trustmark
Organisations seeking independent certification of their converged security readiness against the GCSB CSF Version 2.0 standards. Applications are assessed by the GCSB Assessment Board against the published standards. GCSB governs and certifies; it does not deliver training, consultancy or audit services. Organisational Trustmark evidence reviews are carried out by independent GCSB-Registered External Auditors.
Independence
- GCSB assesses submitted evidence and decides. It does not audit, advise, implement or sell products, and certification does not depend on any vendor or endorsed product.
- Applicants must declare any training, consulting or commercial relationship with a GCSB-accredited provider, including Converged Security Institute. Any Board member connected to such a provider withdraws from the decision.
- The Trustmark is an independent benchmark of readiness. It does not replace ISO/IEC 27001, ISO 22301 or NIST CSF certification, and it is not a statement of legal or regulatory compliance.
Assessment domains
42 questions across ten domains mapped to the GCSB CSF Version 2.0 standards. Domains 1 to 9 are weighted and scored; Domain 10 is a qualifying check that must be met in full.
| Domain | Standard | Weight |
|---|---|---|
| 1. Governance and Leadership | GCSB-ST-CSF-GLA-001 | 15% |
| 2. Risk Management and Assessment | GCSB-ST-CSF-RMA-001 | 15% |
| 3. Technology Integration and Architecture | GCSB-ST-CSF-TIA-001 | 15% |
| 4. Identity and Access Management | GCSB-ST-CSF-IAM-001 | 10% |
| 5. Incident Response and Business Continuity | GCSB-ST-CSF-IRBC-001 | 15% |
| 6. Training and Awareness | GCSB-ST-CSF-TRA-001 | 10% |
| 7. Data Protection and Privacy | GCSB-ST-CSF-DPP-001 | 10% |
| 8. Compliance and Regulatory Alignment | GCSB-ST-CSF-001 | 5% |
| 9. CCSO Policy and Organisational Leadership | GCSB-POL-CSF-CCSO-001 | 5% |
| 10. Continuous Improvement and Monitoring | GCSB-ST-CSF-001 | Qualifying |
Tiers and fees
Every certified organisation receives the GCSB Organisational Trustmark badge together with the tier badge it is awarded. A non-refundable application and assessment fee of £1,300 applies to every application. The tier is set by the Assessment Board from the evidence, not from the self-assessment, and the award fee for that tier is payable before the certificate is issued. Scores below 60% do not receive a Trustmark.
60-69%
Bronze
Foundational converged security arrangements are in place and evidenced across the core domains.
Award fee £850
Total with application fee £2,150
70-79%
Silver
Established, documented and largely implemented arrangements with defined ownership and review.
Award fee £2,150
Total with application fee £3,450
80-89%
Gold
Comprehensive, integrated arrangements operating effectively and tested across domains.
Award fee £4,300
Total with application fee £5,600
90-100%
Platinum
Mature, fully integrated arrangements with evidence of continual improvement and leadership.
Award fee £6,900
Total with application fee £8,200
Certification process
- Pre-certification review of the self-assessment and evidence set.
- Technical validation: the Assessment Board tests the evidence and may ask for clarification or a remote walkthrough.
- Weighted scoring across Domains 1 to 9 and confirmation of Domain 10.
- Decision and tier award, with written reasons if the application is not approved.
Validity and maintenance
- Valid for 12 months from issue; annual revalidation at half the tier fee (£425, £1,075, £2,150 or £3,450) with a fresh self-assessment and evidence update.
- Material changes to the integrated security architecture notified to GCSB within 30 days.
- GCSB may suspend or withdraw a Trustmark if the conditions are no longer met.
- Certificate numbers follow GCSB-OT-YYYY-NNN and can be checked on the verify page.
Who can apply
Companies & institutions only
Open to registered organisations of any sector. The certificate is issued to the organisation, not to individuals. GCSB does not provide audit, consulting or implementation services; organisations submit their own evidence for independent Board assessment.
Fees
£1,300
non-refundable application & assessment fee
Tier award fee after assessment: Bronze £850, Silver £2,150, Gold £4,300, Platinum £6,900 · valid 12 months, then annual revalidation at half the tier fee: £425, £1,075, £2,150 or £3,450
Payment is made by SumUp link after you apply; you then upload your payment document in the Trustmark Portal for verification.
What you receive
- GCSB Organisational Trustmark certificate and badge at the tier awarded
- Public verification on the GCSB register
- Independent benchmark against the GCSB CSF Version 2.0 standards
- Optional listing on the public Trustmark Members list
Prerequisites
- Registered legal entity
- Completed GCSB Organisational Trustmark self-assessment (all 42 questions)
- All Domain 10 continuous-improvement checks met
- Documentary evidence available for every domain on request
- Declaration of any training, consulting or commercial relationship with a GCSB-accredited provider
- Agreement to annual self-assessment and notification of material changes within 30 days
How the application works
- 1
Complete the self-assessment and apply in the Trustmark Portal
- 2
Pay the £1,300 application fee and upload the receipt
- 3
Assessment Board reviews your evidence and assigns a tier
- 4
Pay the tier award fee and upload the receipt
- 5
Certificate issued, valid 12 months, verifiable on the register
Trustmark holders
Loading…