Threats change, workflows change, and your safeguards have to keep pace. Where you begin depends on your budget, your in-house expertise, your size, and the content you handle, and none of those have to be sorted out before you take a first step.
Attackers don’t wait for you to be ready. Not starting is the only mistake.
Four ways in. Pick the one that fits where you are today.
Start with Fix It or Risk It, a free toolkit to identify low effort, high impact everyday security gaps and act on them now. No membership required, and nothing to submit.
Go to Fix It or Risk It
Understand the TPN process: the four TPN Shields, what each one signals to content owners, and the steps that take you from one to the next. Much of TPN is free, so see what is and when membership is required.
See The JourneyRegister on TPN and complete the questionnaire, free. Submit it and you get a gap analysis comparing your results against the MPA Best Practices. Results are confidential and shared with no one at this stage.
Sign Up Free!Pay your membership and begin your assessment process with an accredited assessor. A completed assessment will identify gaps to close and allow you to move up the Shield tiers. Member profiles can be discovered in the TPN registry.
Explore MembershipStart somewhere. Start now. Every week without a fix is a week it’s exploitable.
Four Shields, each building on the last. You do not start over at each tier, the work you have already done carries forward.
Your own self-attestation against the MPA Best Practices, with a gap analysis that only you can see.
An accredited assessor has verified your answers against the evidence, and you have a plan to close the gaps they found.
Every Best Practice gap from your assessment is closed, so you meet the security expectations of most MPA member studios.
You have gone further and completed the Additional Recommendations, the extra layers asked for on the most sensitive work.
The MPA Best Practices contain two kinds of control. Best Practices are the primary controls, reflecting the security expectations of most MPA member studios. Additional Recommendations add further layers, and content owners often ask for them where extra security is needed, and completing both earns Gold Star.
The first four stages are free. How long the rest takes varies with the size of your operation, and the number of sites and applications in scope.
Membership tiers are listed on the membership page.
Free: No Membership Required
Create your account, define your business profile and answer the Best Practices questionnaire for every site and application. You will get a gap analysis showing where you stand against the MPA Best Practices, and you will earn your Blue Shield when you submit. Nothing publishes to the registry until you decide to join.
Set up your company profile in TPN+: your details, locations, subsidiaries and users. Free to create, and nothing publishes until you choose to make your membership active.
Select the services you provide from the TPN service categories. This is what Content Owners search on, and it determines which questions you are asked. A cloud-only provider is never shown site-only controls.
Register every site and every application you develop in-house or license, with no limit on how many. Security is assessed per site and per application, because together they form the complete picture of your environment.
Have more than 3 sites or apps with the same security implementation? TPN offers a “Global Pass” process to reduce your data entry efforts. Contact support@ttpn.org when setting up your profile, before you start your questionnaires.
Earns Blue
Answer the MPA Content Security Best Practices questionnaire for each site and application. If you hold a valid ISO 27001 and upload it to your profile, we pre-populate the matching answers in the questionnaire so you are not entering the same information twice.
You earn your Blue Shield the moment you submit, and that is yours, free. Your results stay hidden, and publishing it to the registry so clients can see it requires an active membership.
Membership Required
See tiered membership fees here
Publish your Shield to the registry, contract an accredited TPN assessor and work through remediation with TPN SecOps. These stages take you from Blue to Silver, Gold and Gold Star.
Earns Silver
A TPN-accredited assessor verifies your questionnaire answers against the evidence, on-site or remotely. Before the final assessment you can run a pre-assessment with your chosen assessor and update your answers if needed. The assessor then submits their assessment for TPN QC, and once QC has approved it the report is published. Anything not yet in full compliance becomes a remediation item, and nearly every assessment finds several. Submit your remediation plan for each item, and that plan is what awards the Silver Shield.
Earns Gold
Work through your remediation items in TPN+ and submit evidence. TPN SecOps reviews it with you and will tell you what evidence is appropriate. When every Best Practice is remediated and reviewed, you reach Gold. Gold tells content owners you meet the security expectations of most MPA member studios, not just that you were assessed, but that you fixed what was found.
Every gap you close is one they cannot exploit.
Earns Gold Star
Remediate the Additional Recommendations as well, the extra measures content owners often ask for on their most sensitive work, all reviewed by TPN SecOps, and you reach Gold Star, the top tier. Every recipient has the option to request a physical TPN Stella Security Award.
None of this requires a membership, an account or a conversation with us.
Fix It or Risk It
Includes low-effort fixes you can make this week, backed by 30+ industry organizations.
MPA Best Practices
The controls behind the questionnaire. Read what good security looks like to your clients.
The TPN STAR Report
What over 1,000 assessments say about where control failures actually happen.
Resources
Reference Guides, How-To Guides, the Assessor Criteria and more.
Ready to go further?
Everything above will show you where you stand. Membership is what makes it count: a published Shield your clients can check, an accredited assessment that verifies what you’ve built, and remediation support to close what it finds.
