Nine domains. A traceable standard.

Starting point

Recorded, broad, and demonstrable

We assess the full fixed framework for every website. The basic checks are always performed; a function-specific check is recorded as not applicable, with a documented reason, only when that function demonstrably does not exist.

OWASP ASVS 5.0.0, Article 32 GDPR and the Belgian CyberFundamentals Framework 2025 serve as substantive references for the control framework.

Assessment domains

83 fixed control points in nine domains

All control points are predetermined and publicly visible. For each point, we register separately whether it has passed, generates a finding, or is demonstrably not applicable.

Nine is the number of security domains, not the number of tests. Each checkpoint includes multiple applicable test scenarios. The C9 numbers retain their original file references. Version 1.2 omits the previous requirement K10-04 for monitoring and timely alerts in case of failure, abuse, and security events. This leaves 83 checkpoints remaining. Regular hosting, backups, and incident handling remain in place.

C9-01 - Scope, architecture and safe preparation

We map the entire website, its functions and safe test conditions before the investigation begins.

• C9-01.001 The exact domain, all associated subdomains and all website environments have been inventoried.File reference: K01-01
• C9-01.002 The owner or an authorized client has permitted the investigation in writing.File reference: K01-02
• C9-01.003 Public pages, administration functions, accounts, forms, APIs and connected services are documented.File reference: K01-03
• C9-01.004 User roles, important actions and business-critical visitor journeys have been mapped.File reference: K01-04
• C9-01.005 The website's personal data, data flows and external recipients have been inventoried.File reference: K01-05
• C9-01.006 Required test accounts and temporary access are provided securely, individually and traceably.File reference: K01-06
• C9-01.007 Safe test windows, emergency contacts and agreements to protect business operations have been confirmed.File reference: K01-07
• C9-01.008 Available backups, recovery options and a rollback path have been checked before changes.File reference: K01-08

C9-02 - Infrastructure, configuration and browser security

We check what is publicly accessible and how the domain, hosting, server, cloud and browser security are configured.

• C9-02.001 DNS, HTTPS, TLS certificates and redirects safely direct visitors to the intended domain.File reference: K02-01
• C9-02.002 Publicly accessible subdomains, services, ports and administration routes are known and necessary.File reference: K02-02
• C9-02.003 Hosting, cloud and server settings restrict access according to the principle of least privilege.File reference: K02-03
• C9-02.004 Browser headers protect against unwanted loading, embedding, interpretation and transmission of information.File reference: K02-04
• C9-02.005 Permitted origins for browser and API traffic are explicitly configured and restricted as much as possible.File reference: K02-05
• C9-02.006 Error messages, debugging functions and status pages do not disclose sensitive technical information.File reference: K02-06
• C9-02.007 Temporary files, backups, source maps, configuration files and development tools are not publicly accessible.File reference: K02-07
• C9-02.008 Caching and intermediary layers prevent personal or confidential content from reaching the wrong visitor.File reference: K02-08

C9-03 - Identity, sessions and access permissions

We assess how users and administrators sign in, recover their accounts and stay signed in. We verify that each user can access only permitted data and actions.

• C9-03.001 Sign-in and registration verify identity without unnecessarily disclosing account information.File reference: K03-01
• C9-03.002 Password rules, storage and change processes support strong and unique passwords.File reference: K03-02
• C9-03.003 Administrator accounts and other sensitive roles use appropriate multifactor authentication.File reference: K03-03
• C9-03.004 Email verification and account recovery use temporary, single-use and securely delivered links or codes.File reference: K03-04
• C9-03.005 Session cookies are protected, restricted to the correct environment and inaccessible to unwanted scripts.File reference: K03-05
• C9-03.006 Sessions are renewed after sign-in and sensitive changes and cannot be taken over through a previously known session.File reference: K03-06
• C9-03.007 Sign-out, automatic expiry, password changes and account blocking correctly end existing access.File reference: K03-07
• C9-03.008 Repeated sign-in attempts and automated account abuse are limited, logged and appropriately followed up.File reference: K03-08
• C9-03.009 Every protected page, API and action checks permissions on the server, not only in the interface.File reference: K04-01
• C9-03.010 Users can view or change only their own data, documents, orders and other objects.File reference: K04-02
• C9-03.011 Roles and permissions follow least privilege and are applied consistently throughout the website.File reference: K04-03
• C9-03.012 Administration functions and sensitive actions are accessible only to explicitly authorized accounts.File reference: K04-04
• C9-03.013 Data from different organizations, customers or workspaces remains technically separated.File reference: K04-05
• C9-03.014 File links, exports and downloads perform the same access checks as the corresponding web page.File reference: K04-06
• C9-03.015 Deactivated accounts and revoked roles immediately lose their previous access.File reference: K04-07
• C9-03.016 Background tasks, integrations and system accounts receive only the permissions their specific function requires.File reference: K04-08

C9-04 - Input, APIs and file handling

We check how the website receives, processes, displays, forwards and handles data as files.

• C9-04.001 All input is checked on the server for permitted format, length, type and meaning.File reference: K05-01
• C9-04.002 Database queries, commands and templates process input without executing data as instructions.File reference: K05-02
• C9-04.003 Displayed content is appropriately encoded so entered text does not become unwanted browser code.File reference: K05-03
• C9-04.004 Actions that change data or settings are protected against requests from unwanted websites.File reference: K05-04
• C9-04.005 File uploads restrict type, size, name and storage location and are processed securely or isolated.File reference: K05-05
• C9-04.006 Downloads and file paths can access only permitted files within the intended storage.File reference: K05-06
• C9-04.007 APIs consistently validate methods, data structures, content types, errors, access permissions and request rates.File reference: K05-07
• C9-04.008 Webhooks, redirects and outbound server connections accept only trusted destinations and valid messages.File reference: K05-08

C9-05 - Privacy and data protection

We compare the website's actual data processing with its privacy information and applicable GDPR obligations.

• C9-05.001 Personal data, categories of data subjects, sources, purposes, recipients and storage locations are fully inventoried.File reference: K06-01
• C9-05.002 The necessity, legal basis and any conditions for sensitive data are substantiated for every website-related processing activity.File reference: K06-02
• C9-05.003 The privacy notice clearly and accurately describes what the website actually does with personal data.File reference: K06-03
• C9-05.004 Forms, accounts and default settings request and display only the personal data needed for the purpose.File reference: K06-04
• C9-05.005 Cookies, pixels and other trackers are correctly categorized and required consent is requested beforehand, freely and demonstrably.File reference: K06-05
• C9-05.006 Consent can be withdrawn as easily as it was given and the website respects the changed choice.File reference: K06-06
• C9-05.007 Retention periods and deletion processes demonstrably work for application data, uploads, logs and relevant backups.File reference: K06-07
• C9-05.008 Website processes support requests for access, correction, deletion, restriction, portability and objection where applicable.File reference: K06-08
• C9-05.009 Website-related processors, external services and international transfers are known and covered by appropriate agreements or safeguards.File reference: K06-09
• C9-05.010 Privacy by design, accountability evidence, any need for a DPIA and preparation for a website-related data breach have been assessed.File reference: K06-10

C9-06 - Secrets and cryptography

We assess how passwords, keys, tokens and sensitive data are protected throughout their lifecycle.

• C9-06.001 Keys, tokens and passwords do not appear in browser code, public files, source code history or logs.File reference: K07-01
• C9-06.002 Secrets are centrally managed, kept accessible only to a limited extent and securely replaced when needed.File reference: K07-02
• C9-06.003 Passwords are stored with a suitable, slow and current password hashing function.File reference: K07-03
• C9-06.004 Sensitive data is protected in transit with current encryption and correct certificate validation.File reference: K07-04
• C9-06.005 Sensitive stored data is encrypted when risk and use require it.File reference: K07-05
• C9-06.006 Cryptographic algorithms, key sizes and settings are current and used for their intended purpose.File reference: K07-06
• C9-06.007 Security tokens and recovery codes are unpredictable, have limited validity, are single-use where needed and can be securely revoked.File reference: K07-07
• C9-06.008 Confidential values do not appear in web addresses, unsecured browser storage, analytics data or shared caches.File reference: K07-08

C9-07 - Dependencies and software supply chain

We check the origin, currency and security of packages, external scripts and the build and publication process.

• C9-07.001 Application packages, runtimes, external scripts and other dependencies are fully and reproducibly inventoried.File reference: K08-01
• C9-07.002 Known vulnerabilities and unsupported versions have been identified and addressed according to risk.File reference: K08-02
• C9-07.003 Versions and lockfiles prevent unexpected changes during installation and build.File reference: K08-03
• C9-07.004 Dependencies come from trusted sources and unnecessary packages or scripts have been removed.File reference: K08-04
• C9-07.005 External browser scripts are limited, reviewed and governed by appropriate browser rules.File reference: K08-05
• C9-07.006 The build and publication process protects source code, artifacts, approvals and production data from unwanted changes.File reference: K08-06
• C9-07.007 Automation accounts and CI/CD secrets have minimal permissions and are not unnecessarily shared with external code.File reference: K08-07
• C9-07.008 Development, testing and diagnostic tools are separated from production and cannot be activated publicly.File reference: K08-08

C9-08 - Business logic and resistance to abuse

We test whether important website processes remain secure during unexpected, automated or improper use.

• C9-08.001 Important user journeys enforce the intended order, conditions and permitted state transitions.File reference: K09-01
• C9-08.002 Prices, discounts, quantities, permissions and other business values are validated by the server.File reference: K09-02
• C9-08.003 Payments, orders, reservations and similar actions are not unintentionally processed twice or out of sequence.File reference: K09-03
• C9-08.004 Limits on requests, accounts, stock, usage or benefits cannot easily be bypassed.File reference: K09-04
• C9-08.005 Invitations, approvals, cancellations and account changes check the current authorization and status every time.File reference: K09-05
• C9-08.006 Forms and public functions are appropriately protected against spam, large-scale abuse and automated fraud.File reference: K09-06
• C9-08.007 Concurrent requests and repeated messages do not cause duplicate benefits or inconsistent data.File reference: K09-07
• C9-08.008 Results from payment providers, identity services and other external parties are independently confirmed on the server.File reference: K09-08

C9-09 - Detection, incidents and recovery

We assess useful logs, incident handling, backups and demonstrable recovery.

• C9-09.001 Sign-ins, administration actions, permission changes, sensitive data actions and security events are logged in a useful way.File reference: K10-01
• C9-09.002 Logs contain no passwords, tokens or more personal data than needed for security and follow-up.File reference: K10-02
• C9-09.003 Log access, integrity, retention periods and timestamps support reliable investigation.File reference: K10-03
• C9-09.005 Backups are created automatically, encrypted, sufficiently separated and according to a defined retention schedule.File reference: K10-05
• C9-09.006 Recovery from backup has been tested recently and meets the agreed recovery objectives for the website and data.File reference: K10-06
• C9-09.007 An incident plan defines reporting routes, responsibilities, evidence preservation and safe emergency measures.File reference: K10-07
• C9-09.008 The data breach process supports timely assessment, documentation and required notification or communication under the GDPR.File reference: K10-08
• C9-09.009 New versions can be published in a controlled manner, monitored and safely rolled back if needed.File reference: K10-09
• C9-09.010 After an incident or significant change, causes, corrections and retests are demonstrably followed up.File reference: K10-10

From signal to evidence

Investigation, remediation, and decision each have their own role

Automated checks

Repeatable checks of configuration, code, dependencies and accessible functions provide signals. A scan result is not yet a confirmed finding.

Targeted investigation

Using suitable tools, test accounts and safe test data, we investigate permissions, accounts, business logic and abuse scenarios, among other areas.

Contextual assessment

Code, architecture, data flows and workflows determine the test scenarios for each control. Missing access remains a limitation and never automatically counts as not applicable.

Agreed remediation

We correct problems within the agreed assignment or guide your developer. Work outside the assignment is discussed in advance.

Retest

Every implemented correction is retested. We record the evidence and any remaining limitations and check important user journeys.

Certification decision

Charter Nine confirms that the investigation and necessary remediation are complete and the retest has passed. The domain can receive C9 Verified only if the applicable requirements are met and confirmed findings are resolved.

Fixed implementation

One fixed standard for every website

Complete base

The basic checks for attack surface, code, configuration, dependencies, privacy, logging, and recovery are performed on every website.

Automatic function modules

Accounts, roles, forms, uploads, payments, APIs, external services, and other existing features automatically make their fixed additional checks mandatory.

Traceable result

We assess the applicable requirements and communicate findings and limitations. Charter Nine confirms the completion of the review, necessary corrections, and successful retest. Missing access does not count as not applicable.

Admission decision

The four pillars of a positive certificate decision

• Full assessmentAll 83 control points have a traceable outcome according to the same fixed decision rules.
• Remediation of confirmed findingsThe agreed remediation of security and privacy findings has been carried out and the result has been substantiated with a successful retest before the certificate is issued.
• Technical retestEvery correction has been re-checked and the important user flows work as intended after the repair.
• Checkable decisionDomain, control date, framework version, validity period, and the issuance decision are recorded together in the certificate file.

Public status rules

The status follows the current evidence

Valid

The last retest was successful and the confirmation is valid until the stated expiration date.

Remediation required

A non-critical new finding is confirmed and has a recorded repair and retest period of up to 30 calendar days, never later than the expiration date. The hosted badge is meanwhile hidden. Without timely successful retest, suspension or expiration follows.

Suspended

A critical or otherwise badge-blocking situation requires immediate action. The badge must not be presented as valid.

Expired

The expiration date has been reached without timely successful re-assessment.

Withdrawn

The conditions have not been met, remediation has been refused or the right of use has been terminated.

Verifiable content

What the certificate concretely includes

• The exact domain investigated and scope of assessment.
• The date of the last successful retest.
• The applied version of this control framework.
• The current status and validity period.
• Issuance by Charter Nine.