Quiz Entry - updated: 2026.10.22
Which three criteria define the trust levels of governance (VSS), and what do levels 1 to 4 require?
Supervision, liability and maturity of the service provider: from internal checks against its own standard (or none), no liability and initial maturity at level 1, up to audit by an accredited body, liability plus contractual penalty and optimised, integrated processes at level 4.
| VSS | Supervision (Aufsicht) | Liability (Haftung) | Maturity (Maturität) |
|---|---|---|---|
| 1 | Internal, by its own standard, or none at all | No liability | Initial |
| 2 | Internal, by predefined rules and standards | Limited liability | Defined |
| 3 | External audit | Liability according to law | Managed, measured |
| 4 | Audit by an accredited body | Liability plus contractual penalty (Konventionalstrafe) | Optimised, integrated |
The guiding questions:
- Supervision: How trustworthy are the service providers, how good is their process quality, how closely are they supervised?
- Liability: To what extent is the provider liable?
- Maturity: How mature is the registration and authentication system? How well can the provider detect its own findings, such as security incidents? How well and how fast can it adapt its processes to new findings, its own or external?
A contractual penalty is a sum agreed in advance that is owed on breach, without the injured party having to prove the exact damage. It turns "we promise to do it right" into a promise with a price.
Go deeper:
Capability Maturity Model: levels (Wikipedia) — the classic initial, repeatable, defined, managed, optimising scale that the maturity criterion echoes.