Risk Assessments
Comprehensive Risk Assessments
Creed performs detailed risk assessments for DeFi protocols, NFT platforms, DAOs, and the entire Web3 ecosystem using a newly standardized methodology based on the NIST Capability Maturity Model (CMM), Cybersecurity Framework v2.0 (CSF), and Secure Controls Framework (SCF). Our assessments evaluate projects across six critical functions: Govern, Identify, Protect, Detect, Respond, and Recover - providing a comprehensive view of an organization's cybersecurity posture and maturity.
Structured Process
We follow a thorough, transparent assessment methodology:
- Pre-Interview Questionnaire - Initial risk profile information
- Detailed Interview - One-hour session with project stakeholders
- Documentation - Recording and comprehensive note-taking
- Analysis & Reporting - Complete evaluation across all functions
- Peer Review - Secondary review for accuracy and objectivity
Benefits for Projects and Investors
Creed's risk assessments provide projects with comprehensive analysis of their security maturity and actionable improvement roadmaps. The standardized approach helps teams prioritize security initiatives, while investors and users can leverage these assessments to make informed decisions about protocol reliability and risk management capabilities.
Partners
Schedule Your Assessment
Schedule a comprehensive risk assessment for your project. Complete our quick form below and we will contact you to discuss your assessment.
Risk Assessment Results
- TBDTier 0Tier 0: Non-existentPending detailsPending
The Silo Protocol is a non-custodial lending primitive that creates programable risk-isolated markets known as silos. Any user with a wallet can lend or borrow in a silo in a non-custodial manner. Silo markets use the peer-to-pool, overcollateralized model where the value of a borrower's collateral always exceeds the value of their loan.
Understanding Risk Maturity Tiers
These tiers draw upon the high-level structure of the Capability Maturity Model (CMM) and Secure Controls Framework (SCF). The Tiers characterize the rigor of an organization's cybersecurity risk governance practices (GOVERN) and cybersecurity risk management practices (IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER).
Risk governance is not defined and risk management is not performed.
Risk strategy is managed in an ad-hoc manner. Limited awareness of cybersecurity risks with case-by-case implementation.
Practices are approved but not organization-wide. Cybersecurity information is shared informally.
Formal governance structure with standardized, documented policies. Organization-wide approach to security management.
Quantitatively controlled practices with metrics-driven governance. Cybersecurity information is routinely shared.
World-class practices with continuous improvement. Security is part of organizational culture with real-time adaptation.