How It Works
Earn your credential. Verify the trust.
Five steps, from a free Trust Audit to a Trust Badge someone else can check. The audit does not issue a credential.
The pathway
How a business earns a Trust Badge
Five steps. The free Trust Audit comes first, and it does not issue a credential.
Step 1
See where you stand
Start with the free Trust Audit. You get a results page from what you reported. It does not issue a Trust Badge.
Step 2
Do the readiness work
Work through the 15 required credentialing areas. The questions are practical: passwords, email, backups, and who can see client files.
Step 3
Legacy Core reviews it
We review what you submitted against the Bronze standard. Paying starts the pathway. It does not issue the badge.
Step 4
You get a page someone can check
If the Bronze requirements are met, the business receives a Trust Badge and a listing in the Public Business Trust Registry.
Step 5
Keep it current
The listing stays up while the credential is in good standing. Silver and Gold come later. They need documented evidence, and they cannot be bought or self-declared.
Who does what
Legacy Core creates the trust signal. Partners implement security.
Implementation providers help businesses improve. Legacy Core determines whether the credential has been earned. Partners do not award the badge.
- 1
Business
Understands readiness, completes the credentialing pathway, implements improvements where needed, and supplies required information and evidence.
- 2
Legacy Core
Maintains the credentialing pathway and credential standard, reviews the application, determines credential status, and issues the Trust Badge when requirements are met.
- 3
Alliance Partners and qualified providers
May help implement cybersecurity improvements and submit evidence-backed attestations. Partner attestation is not independent review. They do not issue Legacy Core credentials.
- 4
Customers and credential readers
Use the Public Business Trust Registry to check status and understand the recorded scope. Each customer or organization decides whether it meets their needs.
Implementation is separate from credentialing. See Alliance Partners · Governance · Discuss an evidence-review role
Implementation is separate from credentialing. Alliance Partners may implement security. They cannot purchase, guarantee, or self-award a Trust Badge.
Frequently asked questions
Do I need the Trust Check first?
You can pursue Bronze credentialing directly, but the 2-Minute Business Trust Check is the recommended starting point. It is diagnostic only. It does not issue a credential.
What happens after I earn Bronze?
Credentialed businesses appear in the Public Business Trust Registry. They may work with Alliance Partners and other trusted professionals as cybersecurity maturity grows. Partners may implement security. Legacy Core determines whether a higher credential has been earned.
How long does the credentialing pathway take?
Many businesses complete Bronze in a few weeks, depending on how quickly they can finish the readiness work. There is no fixed deadline.
What happens if more work is needed before a credential is issued?
Legacy Core will tell you that the credential is not ready to issue yet. You can continue the pathway and come back when the business meets the applicable credential standard.
How is this different from a class?
Legacy Core issues credentials. It does not run a class. The pathway ends in a Trust Badge and a live registry listing.
How do I earn Silver or Gold?
Silver and Gold are earned outcomes, never sold direct. Silver and Gold cannot be earned through self-attestation. Alliance Partners may help implement improvements and submit supporting evidence. Qualified external reviewers may evaluate evidence when appointed. Those relationships are being established. Buying implementation work or a security product does not issue the badge. Legacy Core determines whether the credential has been earned.
What appears in the public registry?
Credential information a customer or partner needs to verify status: business name, tier, credential status, area served, and related public dates when shown. Owner contact information, payment data, uploaded evidence, internal notes, and review history are never displayed publicly.
What if I let my credential lapse?
A lapsed credential shifts to Expired status in the registry. Verification pages continue to load, but the badge is no longer valid. You can renew to return to good standing.
See the pathway from the inside.
Start with the free Trust Audit, or begin Bronze credentialing when you are ready. Silver and Gold cannot be earned through self-attestation.