Straight answers, on the record.

Cyber 360 is an evidence-based cybersecurity readiness certification program administered by the Cyber 360 Program Office. An authorized assessor reviews the safeguards, policies, procedures, tools, and documentation in place at a specific business location. When the review is approved, the location earns a Bronze, Silver, Gold, or Platinum certificate that anyone can verify through exact lookup.

Cyber 360 certifies locations, not companies. Each certificate is tied to a specific certified location and its reviewed environment. A company with several offices may certify one, some, or all of them, each on its own schedule, with its own level and verification record. If a single location represents the full organization, the certificate reflects that scope.

No. A certificate applies only to the certified location, network environment, systems, users, and reviewed scope identified for the assessment. It should not be presented as applying to unreviewed companies, related entities, affiliated locations, networks, systems, users, vendors, or services.

Small and mid-sized businesses, medical and dental offices, professional practices, nonprofits, schools, and municipal offices, organizations that want credible, practical recognition of their cybersecurity readiness without an enterprise-scale audit.

Bronze (foundational), Silver (core readiness), Gold (advanced), and Platinum (comprehensive). Each level reflects an increasing depth and breadth of safeguards reviewed at the location. See the certificate levels catalogue for what each level covers.

You don’t need to decide alone. Request an assessment and note that you’d like a recommendation, the review will identify a realistic current level and a practical path to your target level.

Yes. Every certified location has a tracked maturity path: current level, recommended next level, target level, and next steps. Upgrade assessments can be scheduled when you’re ready.

After scope is agreed, an authorized assessor reviews your safeguards and documentation against the requirements for the target level. Results are documented internally and independently reviewed by a program administrator before any certificate is issued.

Only authorized program personnel. Uploaded evidence defaults to internal-only visibility, and detailed findings, technical reports, and vulnerabilities are never displayed publicly. Public register entries show only approved certificate facts and curated achievements. See the Privacy page.

Each certificate shows its own issue date and expiration or renewal date, typically a one-year validity period. The public register entry always displays the current status and dates.

Your renewal contact receives reminders as the renewal date approaches. A renewal review confirms safeguards are still in place, and an approved renewal issues a new certificate. The prior certificate is marked “Superseded” and its register entry points verifiers to that fact.

The certificate status becomes “Expired” after the validity period ends, and it should no longer be presented as current. The register entry reflects the expired status.

Two ways: scan the QR code on the certificate or sticker (which opens the register entry directly), or enter the certificate number and verification code on the verify a certificate page.

By design. Verification is lookup-based: only someone who has been presented with a certificate, QR code, or verification code can check it. This protects certificate holders from scraping, unwanted solicitation, and misuse of certification claims, and it keeps a lookup meaningful.

It shows approved certificate facts only: certified location name, city/state, level, status, certificate number, dates, a limited reviewed-scope summary, and any curated public achievements. It never shows review findings, technical details, vulnerabilities, evidence, internal reports, or personal information.

The certificate number and verification code must match exactly. For privacy and security, the lookup gives the same generic response whether a record doesn’t exist, doesn’t match, or isn’t publicly available. If you believe a certificate should verify, contact the program administrator.

• Active

  The certificate is currently valid within the reviewed scope and validity period.

• Expired

  The certificate validity period has ended and the certificate should not be presented as current.

• Suspended

  The certificate is temporarily inactive pending review, clarification, or updated information.

• Revoked

  The certificate has been withdrawn and should no longer be used or displayed as valid.

• Under Review

  The certificate or related scope is being reviewed before status is confirmed.

• Superseded

  A newer certificate has replaced the prior certificate.

No. Certification is a point-in-time recognition based on evidence reviewed within the agreed scope as of the assessment date. It is not a guarantee, warranty, legal opinion, audit opinion, insurance approval, or government certification, and it does not ensure protection from future cyber incidents. Read the full disclaimer.

The public register entry updates immediately to show the new status, and the certificate should no longer be presented as valid while suspended or after revocation. Status changes are documented internally with a reason, and the certificate holder is notified according to program policy.

Assessment requests and contact submissions create internal records used to respond to you and administer the program. Assessment evidence stays internal-only by default. The program does not collect or store billing or payment information through this website. Full details are on the Privacy page.