Frequently asked questions
The questions clients, supervisors and procurement teams ask most often, answered in the same terms used in service descriptions. Each answer links to the page that covers the subject in full.
What Client Focus does
Services
- What do Build, Run and Secure include?
- Build covers network design, node and validator engineering, smart contracts, tokenization and banking and payments integration. Run provides continuous network operations under ITIL-based incident, problem and change management. Secure provides 24/7 security operations, assessments and incident response.
- What is C'ROC?
- C'ROC is the Client Focus blockchain security operations center, staffed continuously by Watch Officers who validate every detection before notification. Its Chain Monitor layer watches wallet, contract, validator and counterparty behavior. It is delivered as a Client Focus solution.
- Which networks are monitored?
- Coverage includes Ethereum, Solana, BNB Chain, Avalanche, Polygon, Arbitrum, Optimism, Base and Sonic, formerly Fantom. Additional networks are added by agreement during scoping. Layer 1 and Layer 2 coverage is treated as one monitored path, including the settlement route.
- Are permissioned networks supported?
- Yes. Client Focus builds and operates permissioned deployments, including Hyperledger and Corda, alongside public networks. The operating model, escalation chain and evidence record are the same in both cases.
- Does Client Focus operate a network operations center as well?
- Yes. The digital asset network operations center holds availability of nodes, validators, RPC endpoints and integrations to a published standard. It shares telemetry with the security operations center so infrastructure degradation is treated as a possible security signal.
How the watch works
Security and custody
- Does Client Focus hold client keys?
- No. Client Focus is non-custodial and clients retain control of their keys. Monitoring uses read access, forwarded logs and API integration, and privileged operations remain with the client's own approval process.
- How do notification and escalation work?
- A detection is validated by the Watch Officer on shift, assigned a severity and opened as an incident. Notification follows within ten minutes of detection, with client acknowledgment expected within fifteen. Escalation runs through four documented levels, each with a named owner and a timestamp.
- What do the severity tiers mean?
- Severity is a three-tier framework agreed with the client before service starts, so classification is not decided during an incident. The tier determines who is notified, how quickly and through which channel. Privileged on-chain actions and broken invariants are treated as critical by default.
- How is evidence retained?
- Detections, decisions, notifications and escalation hops are recorded with timestamps in the operating system of record. Retention periods are set in the service agreement to match the client's regulatory obligations. Evidence packs are produced from those records rather than reconstructed later.
- What happens during an active incident?
- Containment support, coordination with the client's response team and, where relevant, outreach to exchanges and infrastructure providers run in parallel with client notification. A post-incident review follows with a written timeline. Existing clients reporting an incident should use the support page instructions.
Controls and evidence
Compliance
- Is Client Focus certified to ISO/IEC 27001?
- Yes. The certified information security management system covers the engineering and operations activities delivered from the Ashburn and Hyderabad centers. The certificate and statement of applicability are available under non-disclosure agreement.
- What is the SOC 2 status?
- A SOC 2 Type II examination is underway. Client Focus does not describe the report as held until the examination is complete. Current control documentation is available under non-disclosure agreement in the interim.
- How is DORA evidence produced?
- Incident timelines with hop-by-hop timestamps, access and change records, supplier assessments and continuity test results come out of the operating record. Chain infrastructure suppliers, including RPC providers, indexers, oracles and bridges, are documented for the register of information.
- How is MiCA evidence produced?
- Custody and position records, service descriptions, complaint and incident logs and the outsourcing register are maintained as operating artifacts. MiCA and DORA are run as one program because DORA supplies the resilience rules MiCA presumes.
- How is GENIUS Act evidence produced?
- Reserve to supply reconciliation, privileged-action monitoring for mint, burn, pause and role changes, and third-party oversight records are produced continuously. Those records support the board-approved information security risk and control framework the implementing rules describe.
- Can engineering and security operations be separated?
- Yes. Where a client or its supervisor requires separation of duties, the teams that build a system and the teams that monitor it operate under independent reporting lines, with separate access and separate change authority. The separation is documented in the service agreement and attested for audit.
Engagement and onboarding
Commercial
- What engagement models are available?
- Subscription for continuous monitoring and managed operations, annual retainer for reserved incident response and advisory capacity, fixed-price project for assessments and compliance work, and time and materials for evolving programs. The model is chosen during scoping with an operations lead.
- How long does onboarding take?
- Most services are live within two to four weeks of contract. On-chain monitoring of registered contracts is active within 24 hours. Integration into the client's existing security stack runs in parallel with rule tuning.
- Where is client data held?
- Data residency options are available in the United States, the European Union and India, with single-tenant deployment for regulated workloads. The detection engine runs within Client Focus infrastructure or the client's designated environment, and no client data leaves the agreed boundary.
- Is an evaluation period available?
- Yes. Evaluation periods are available for monitoring services, scoped to a defined set of wallets and contracts. There is no requirement to replace the client's existing SIEM, EDR or cloud tooling, since integration is by API, agent or log forwarding.
- How is the due-diligence pack requested?
- Requests go to the procurement mailbox or through the contact form, selecting Trust and compliance as the area of interest. The pack includes the control framework summary, certification evidence and the standard service terms, released under non-disclosure agreement.
How the clock runs
Detection, notification and escalation
The two diagrams below restate the answers above: the notification clock from detection to client acknowledgment, and the four escalation levels with their named owners.
Documents
Requesting the due-diligence pack
Procurement and risk teams can request the control framework summary, certification evidence and standard service terms under non-disclosure agreement.
procurement@clientfocusllc.com
Terms used in these answers are defined in the digital asset operations glossary.
Question not answered here?
Describe the estate, the coverage required and the gaps. A principal of the firm reviews every request.