Trust Marks
Bronze, Silver, and Gold Trust Marks are visible signals tied to live verification in the Public Business Trust Registry. Trust should be verifiable.
Bronze establishes readiness. Silver verifies implementation. Gold demonstrates continued maturity.
Know → Show → Maintain
Baseline Readiness
Bronze establishes baseline cybersecurity readiness under the applicable Legacy Core credential standard.
The business completed Legacy Core's baseline credential requirements and is listed in the Public Business Trust Registry. Bronze does not claim that every control has been technically verified.
Evidence-Verified Implementation
Silver recognizes documented implementation that has been reviewed under the applicable Legacy Core credential standard.
Silver is earned when documented implementation has been reviewed. Silver cannot be earned through self-attestation. Businesses may progress through an Alliance Partner-supported or independent review pathway.
Ongoing Verified Readiness
Gold recognizes continued cybersecurity readiness demonstrated over time under the applicable Legacy Core credential standard.
Gold is the highest published Trust Badge tier. It recognizes continued readiness demonstrated over time. Gold cannot be earned through self-attestation.
Why it matters
Customers, lenders, insurers, and partners increasingly ask for proof, not promises. A Legacy Core Trust Mark links to live verification in the Public Business Trust Registry. Not a logo you made in Canva.
What it means and what it does not
A reviewed credential, not a marketing claim. Human-reviewed readiness with live verification in the registry.
The Trust Badge means
Bronze: Build the foundation.
Complete the baseline credentialing pathway. Earn your first Trust Mark and a registry listing.
Silver: Strengthen your readiness.
Requires additional validation through an Alliance Partner-supported or independent review pathway. Cannot be self-declared.
Gold: Demonstrate maintained readiness.
Recognizes continued readiness over time. Requires evidence and review. Cannot be self-declared.
The Trust Badge does not mean
Not a government credential
Legacy Core is a private credentialing authority, not a regulator. The badge is not a license, permit, or government endorsement.
Not a guarantee of any outcome
The badge demonstrates commitment to readiness; it does not promise the absence of risk or any particular incident outcome.
Not transferable
The credential belongs to the credentialed business. It cannot be assigned to subsidiaries, affiliates, or successor entities without re-credentialing.
Not managed cybersecurity
Legacy Core is a credentialing authority. It does not sell MSP, MSSP, or monitoring services. Implementation stays with providers the business chooses.
Not issued by a purchase
Buying software, monitoring, or an Alliance Partner package does not issue a Trust Badge. Legacy Core reviews whether credential requirements have been met.
Bronze. Silver. Gold.
Bronze is sold direct. Silver and Gold are earned outcomes. Silver and Gold cannot be earned through self-attestation.
Know → Show → Maintain
Baseline Readiness
Know it. Document it. Own it.
Bronze establishes baseline cybersecurity readiness under the applicable Legacy Core credential standard.
Start here
↓
Sold direct
Begin the credentialing pathway and earn Bronze through Legacy Core directly.
Evidence-Verified Implementation
Show it.
Silver recognizes documented implementation that has been reviewed under the applicable Legacy Core credential standard.
Cannot be earned through self-attestation
↓
Alliance Partner-supported pathway
Alliance Partners may help implement cybersecurity improvements. Legacy Core determines whether Silver has been earned.
Independent review pathway
Businesses may also progress through an independent review pathway. Self-attestation is never accepted.
Ongoing Verified Readiness
Maintain it.
Gold recognizes continued cybersecurity readiness demonstrated over time under the applicable Legacy Core credential standard.
Cannot be earned through self-attestation
Alliance Partner-supported pathway
Alliance Partners may help implement additional protections. Legacy Core determines whether Gold has been earned.
Independent review pathway
Businesses may also progress through an independent review pathway. Self-attestation is never accepted.
Display guidance
Wherever the badge appears, it must link to your verification URL. That live link is what makes the credential trustworthy.
Do
Do not
Verification link behavior
Every credential has a verification URL at /verify/<credential-ID>. The page returns one of three public-facing states in real time: Verified, Expired, or Not Found.
See a verification pageMisuse and revocation
Reports of badge misuse (display after expiration, display of a tier the business has not earned, modified artwork, or impersonation of a credentialed business) are investigated by Legacy Core. Confirmed misuse results in credential revocation. Public verification then returns Expired so reviewers see an accurate status.
Report suspected misuse: verify@legacycore.com
That the business has progressed through Legacy Core’s structured credentialing pathway at the displayed tier and is listed in the Public Business Trust Registry. Legacy Core Trust Badges are visible signals of progress with live verification, not a claim of legal compliance.
Silver and Gold cannot be earned through self-attestation. Businesses may progress through an Alliance Partner-supported or independent review pathway. Buying implementation work does not issue the badge. Staying listed on the registry is $199/year or $19/month.
No. Legacy Core does not require businesses to purchase cybersecurity implementation services or a specific security product to earn a credential. You may work with qualified providers of your choice. Legacy Core determines whether the credential requirements have been met.
Every credentialed business receives a verification URL of the form /verify/[credential-ID]. Wrap the badge image in a link pointing to that URL. The page returns one of three public-facing states: Verified, Expired, or Not Found.
Suspected misuse can be reported to verify@legacycore.com. Legacy Core investigates each report, contacts the business, and revokes the credential where misuse is confirmed. A revoked credential returns Expired on the public verification page.
No. The badge must be removed from all displays when the credential expires, lapses, or is revoked. Continued display is a misuse and can result in revocation.
Protect what you built. Display your Trust Mark and link it to the Public Business Trust Registry.