# SOS Standard — Solana Organization Security > **Status: Work in Progress** > The SOS Standard is under active development. Controls, level definitions, and supporting material are subject to change as the standard is refined through real-world assessments and community feedback. We welcome input from protocol teams, auditors, and the broader [Solana](https://solana.org) ecosystem. The **SOS Standard** is an open security framework built specifically for [Solana](https://solana.org) protocol teams. It covers the full operational surface of a Solana organization: on-chain authority design, multisig and signing security, device and endpoint hardening, identity and access management, software supply chain, infrastructure, public communications, monitoring, and incident response. This is not a generic cybersecurity checklist. Every control is written for teams that ship Solana programs, hold upgrade authority, manage treasury multisigs, publish npm/crates packages, and operate public-facing products. ## Certification Levels | Level | Label | Target | |-------|-------|--------| | **L1** | Baseline | Pre-launch teams, minimal authority and value at risk | | **L2** | Managed | Most live protocols with user funds (recommended minimum for any live protocol) | | **L3** | Hardened | Lending, liquid staking, perps, $25M+ FAR, mint/freeze authority | | **L4** | Critical | Stablecoins, bridges, oracles, systemic dependencies, $100M+ FAR | The target level is determined by a **criticality taxonomy** that scores across four dimensions: upgrade authority risk (U0-U4), mint/freeze authority risk (M0-M4), off-chain blast radius (O0-O4), and Funds at Risk / FAR (V0-V4). FAR is the maximum value that could be lost if the protocol is fully compromised — not the same as TVL. See the [[general/sos-standard|main standard]] for details. ## Ecosystem References The SOS Standard references several Solana ecosystem tools, governance platforms, and security programs: | Tool / Platform | Description | |----------------|-------------| | [Solana](https://solana.org) | The Solana blockchain | | [Accretion](https://accretion.xyz) | Solana security firm — original author and maintainer of this framework | | [Squads](https://squads.so) | Multisig protocol for Solana (Squads Protocol v4) | | [Realms](https://realms.today) | SPL Governance UI for DAOs and multisigs | | [MetaDAO](https://themetadao.org) | Futarchy-based governance on Solana | | [Anchor](https://www.anchor-lang.com/) | Solana smart contract framework | | [Triton](https://triton.one) | Solana RPC infrastructure provider | | [Helius](https://helius.dev) | RPC, webhooks, and on-chain data infrastructure | | [OtterSec](https://osec.io) | Solana security auditor and verified builds provider | | [SEAL 911](https://seal911.org) | Security Alliance emergency response for crypto incidents | ### Solana Security Programs | Program | Description | |---------|-------------| | [STRIDE](https://blog.asymmetric.re/introducing-stride-a-security-program-for-the-solana-ecosystem/) | **S**olana **T**rust, **R**esilience and **I**nfrastructure for **D**eFi **E**nterprises — a security evaluation program by Asymmetric Research and the Solana Foundation. Protocols with $10M+ TVL can [apply for assessment](https://docs.google.com/forms/d/e/1FAIpQLSfwHege_H4TyJGI50hYtx-mfOmNukJyT_c9v4oO4KdOEqC1Mg/viewform). ([Announcement](https://x.com/SolanaFndn/status/2041246400977965124)) | | SIRN | **S**olana **I**ncident **R**esponse **N**etwork — a membership-based network of security firms (Asymmetric Research, OtterSec, Neodyme, Squads, ZeroShadow) providing threat intelligence sharing, coordinated incident response, and 24/7 protection | ## Content Overview ### [[general/sos-standard|Main Standard]] The core standard document defines certification levels, the criticality taxonomy, threat model, control requirements per level across all domains, the certification process, and the implementation roadmap. ### [[wiki/README|Security Knowledge Base (Wiki)]] A knowledge base of **55 detailed, actionable security guides** covering every area a Solana protocol team needs to secure. Each article tells you exactly what to configure, why, and what the risks are if you don't. **Topics covered:** - **On-Chain Authority & Program Security** — multisigs, [Squads](https://squads.so), [Realms](https://realms.today), futarchy/[MetaDAO](https://themetadao.org), upgrade authority, authority design, circuit breakers, token authority, verified builds, PDAs - **Wallet & Key Management** — hardware wallets, seed security, hot wallets, signing workflows - **Identity & Access** — password managers, MFA, security keys, SIM security, email security - **Social Media & Communications** — X (Twitter), Telegram, Discord, crisis communications - **Development & Supply Chain** — GitHub, CI/CD, npm, Cargo, dependency management, dev environment, AI security - **Infrastructure** — RPC security, infrastructure access, secrets management, domain/DNS - **Devices & Endpoints** — signer devices, device management, travel security - **Organizational** — personnel security (incl. DPRK threat), access reviews, incident response, physical security, scam awareness, monitoring, insurance, complementary standards ### Level Guides & Auditor Checklists Each certification level has a **client-facing implementation guide** (step-by-step playbook for achieving certification) and an **auditor checklist** (structured assessment worksheet with evidence columns): | Level | Implementation Guide | Auditor Checklist | |-------|---------------------|-------------------| | L1 — Baseline | [[level1/guide]] | [[level1/auditor-checklist]] | | L2 — Managed | [[level2/guide]] | [[level2/auditor-checklist]] | | L3 — Hardened | [[level3/guide]] | [[level3/auditor-checklist]] | | L4 — Critical | [[level4/guide]] | [[level4/auditor-checklist]] | ### [[templates/README|Document Templates]] Ready-to-use templates for all operational documents referenced throughout the standard: asset inventories, authority maps, incident response playbooks, onboarding/offboarding checklists, policy documents, and more. Each template lists the SOS level at which it becomes required. ## Key Principles 1. **Solana-specific.** Every control is grounded in [Solana](https://solana.org)'s architecture — upgrade authority, PDAs, loader-v3, [Squads](https://squads.so), durable nonces, versioned transactions, [Anchor](https://www.anchor-lang.com/) IDL authority. 2. **Actionable specificity.** Articles include exact CLI commands, configuration steps, and code examples — not just abstract recommendations. 3. **Threat-informed.** Controls reference real incidents: the Drift hack, the `@solana/web3.js` supply chain attack, DPRK IT worker infiltration, SIM swap attacks, and social channel takeovers. 4. **Proportional.** Four certification levels ensure that a pre-launch project isn't burdened with L4 controls, while a $100M bridge isn't hiding behind L1 minimums. 5. **Bottom-up architecture.** The wiki articles form the knowledge base. The SOS levels compose from them, specifying which configurations are required at each certification level. ## How to Use This Standard **If you're a Solana protocol team:** 1. Read the [[general/sos-standard|main standard]] to understand the certification levels and determine your target level 2. Read the [[level1/guide|level guide]] for your target level for a step-by-step implementation playbook 3. Browse the [[wiki/README|wiki]] for detailed guidance on each security area 4. Use the [[templates/README|document templates]] to create the required operational documents 5. Use the SOS Level Requirements tables in each wiki article to understand exactly what's required at your target level **If you're an auditor or assessor:** 1. Use the [[general/sos-standard|main standard]]'s certification process section for assessment methodology 2. Use the [[level1/auditor-checklist|auditor checklist]] for your target level as a structured assessment worksheet 3. Reference individual wiki articles for control-specific verification guidance 4. Apply the audit decision states: Certified, Conditionally Certified, or Not Certified ## Repository Structure For those accessing this content via GitHub: ``` general/ sos-standard.md Main standard document — levels, controls, certification process wiki/ Security knowledge base — 55 detailed topic guides README.md Wiki index and topic map authority-design.md In-protocol authority architecture (with Anchor code examples) multisigs.md General multisig security principles squads.md Squads Protocol v4 configuration and security realms.md Realms / SPL Governance configuration and security futarchy.md MetaDAO / futarchy governance security upgrade-authority.md Program upgrade authority management circuit-breakers.md Emergency stop and program state management ... 40+ additional topic guides (see wiki/README.md) level1/ through level4/ Level-specific implementation guides and auditor checklists guide.md Client-facing step-by-step implementation playbook auditor-checklist.md Auditor assessment worksheet with evidence columns templates/ Document templates for inventories, policies, and procedures README.md Template index organized by category and level evidence-guide.md Evidence collection methodology for auditors interview-script-*.md Interview scripts for each certification level ... 30+ operational document templates references/ Source material and reference documents ``` ## Linting A framework linting script validates structural consistency across all documents: ```bash bash scripts/lint-framework.sh ``` The linter checks: 1. **Control ID format & uniqueness** — all IDs in the registry match `SOS-[A-Z]{2,4}-[0-9]{3}`, no duplicates, no gaps 2. **Control ID references** — every `SOS-XXX-NNN` string in any file exists in the control registry 3. **Section references** — `Section X.Y` references in the main standard resolve to real section headings 4. **Wikilink validation** — all `[[target]]` links resolve to existing files 5. **Stale counts** — no hard-coded article or control counts that have drifted from actuals 6. **Known bad patterns** — stale dates, deprecated URLs, incorrect terminology Requires [ripgrep](https://github.com/BurntSushi/ripgrep) (`rg`) and Python 3. ## About The SOS Standard is an open framework developed and maintained by [Accretion](https://accretion.xyz). It is designed to be used by any Solana protocol team for self-assessment and by any qualified security firm for formal certification assessments. Contributions, feedback, and adoption by the broader Solana security ecosystem are welcome. If you want to contribute, report issues, or discuss the standard, open an issue or pull request in this repository.