What Is TPN Certification?
The Trusted Partner Network (TPN) is a content security program wholly owned by the Motion Picture Association (MPA). It maintains the MPA Content Security Best Practices and runs an assessment program built on them. Studios and streaming platforms use it to review the security practices of their vendors: post-production houses, VFX studios, sound facilities and creative agencies that handle pre-release content.
Most people search for "TPN certification", so that is the phrase we use for the topic. TPN itself is careful about the word. It says its assessments and Shield statuses are not an approval, a certification or a pass or fail. A Shield shows where you stand against the Best Practices, and each content owner makes its own risk-based decision using it.
If you work with major studios, broadcasters or streaming platforms, expect to be asked about your TPN status at some point. What a particular client requires is that client's call, so ask their vendor security team what they expect from you.
Why Does TPN Exist?
Historically, each major studio ran its own content security audits, sending its own team to vendors' facilities. That was expensive, repetitive and inconsistent. TPN gives the industry one benchmark, the MPA Content Security Best Practices, and one place to share the results: a platform called TPN+, which is also a registry of service providers. A vendor completes the questionnaire and assessment once, and content owners that take part in the program can review it.
The Four Shields
Since September 2025 TPN has used four Shield tiers. Before that there were two, Blue and Gold, and Classic Gold Shields stay valid until they expire.
- Blue: you complete the self-assessment questionnaire against the Best Practices, and it is published on TPN+. No assessor is involved.
- Silver: a TPN-accredited assessor has verified your answers against evidence, and you have submitted a remediation plan for the gaps they found.
- Gold: every Best Practice gap from your assessment has been closed, with the remediation reviewed by TPN.
- Gold Star: you have also completed the Additional Recommendations, again reviewed by TPN.
Blue is valid for one year from submission. Silver, Gold and Gold Star are valid for two years from the publication of your assessment report. Because a Shield is not a pass or fail, it is better read as a progress marker than as a grade.
The TPN Assessment Process
Step 1: Start in TPN+ and Run a Gap Assessment
Creating a TPN+ account and completing the Blue questionnaire is free, and the questionnaire works as a gap analysis that only you can see. Before the formal assessment, many studios also run their own gap assessment (or have a consultant do it) against the MPA Content Security Best Practices. TPN publishes the Best Practices on its resources page, and the current version changes from time to time. At the time of writing, TPN lists v5.3.2 with an AI Supplemental, but confirm the current version with your assessor before you start.
Step 2: Choose an Assessor
TPN assessors are independent third parties accredited by TPN. You choose one from the assessor directory on TPN's website, agree scope and price with them directly, and contract with them yourself. TPN suggests collecting more than one bid. An active TPN membership is needed to complete an assessment on the platform.
Cost and timeline vary with your facility, your scope and the assessor. TPN publishes its membership fees, which scale with annual gross revenue, at trustedpartnernetwork.org/membership. Those fees do not include third-party assessment costs, so ask assessors for quotes.
Step 3: The Assessment and Remediation
The assessor verifies your answers, on site or remotely, and the result is an assessment report. Nearly every assessment finds items to fix, so do not treat findings as a failure. Submitting a remediation plan for them earns Silver. Common gaps include:
- Inadequate network segmentation
- No formal asset handling procedures
- Missing endpoint encryption
- Weak access control policies
- Insufficient logging and monitoring
Step 4: Close the Gaps and Move Up the Shields
You track remediation in TPN+ and submit evidence for review by TPN. When every Best Practice item is closed and reviewed, the Shield becomes Gold. Closing the Additional Recommendations as well earns Gold Star. There is no fixed deadline for remediation, and partial progress still counts while you hold Silver. Your Shield is published in the TPN+ registry, where clients that participate in the program can look you up.
Key Technical Controls
The Best Practices group their controls into four domains. Each one is split into topics, and you only answer the controls that apply to your scope.
Organizational Security: policies and procedures (information security management, acceptable use, business continuity, disaster recovery), risk management, personnel security (background screening, onboarding and offboarding, training) and incident response.
Operational Security: receiving, packaging and shipping content, work-from-home and remote sites, and asset tracking and destruction.
Physical Security: entry and exit points, visitor logs, electronic access control and monitoring, alarms, keys and camera systems.
Technical Security: the largest domain. It covers endpoint protection, authentication and authorization, network configuration (segmentation, firewalls, remote access, wireless), encryption, vulnerability management, patching, zero trust, applications and, in the latest version, AI and machine learning tools.
How Long Does It Take?
It depends on your starting point, your scope and the assessor's schedule. Studios with mature IT practices have less to fix than studios with none of the basics written down. TPN's own quick start guide suggests aiming for a first Shield within 90 days. That is a target, not a promise, so plan from the results of your gap assessment.
Working With a Consulting Partner
Most creative studios don't have dedicated IT security staff. A production IT consulting partner can help you get ready: leading the gap assessment, implementing missing controls, writing policies and preparing documentation. The assessment itself is always done by an independent TPN-accredited assessor, and no consultant can certify you or promise a Shield.
The Business Case
Many content owners look at a vendor's TPN status when they decide who can handle unreleased work, and a published Shield in the TPN+ registry gives them something concrete to check. Whether a given client requires one, and which Shield they expect, is that client's decision. Getting ready before a client asks is usually easier than doing it under a deadline.
Clouds Agency provides production consulting services including TPN readiness assessments, network design, and infrastructure implementation for creative studios in Los Angeles. We help you get ready; an independent TPN-accredited assessor does the assessment. Learn more about our production consulting services.
Written by the team at Clouds Agency, a Los Angeles creative and production consulting agency.