CSA Seeks Input For Open Peer Review: CCM v3.0

The Cloud Security Alliance (CSA) today has released a draft of the latest version of the Cloud Control Matrix, CCM v3.0. This latest revision to the industry standard for cloud computing security controls realigns the CCM control domains to achieve tighter integration with the CSA’s “Security Guidance for Critical Areas of Focus in Cloud Computing version 3” and introduces three new control domains. The draft version of CCM v3.0 is available for peer review through the CSA Interact website with the peer review period closing March 31, 2013, and final release of CCM v3.0 in the fourth quarter of 2013. https://interact.cloudsecurityalliance.org/index.php/ccm/v3_group_1 https://interact.cloudsecurityalliance.org/index.php/ccm/v3_group_2 https://interact.cloudsecurityalliance.org/index.php/ccm/v3_group_3 The three new control domains; “Mobile Security”, “Supply Change Management, Transparency and Accountability”, and “Interoperability & Portability” address rapidly expanding methods cloud data is accessed, the need for ensuring due care is taken in the cloud providers supply chain, and the minimization of service disruptions in the face of a change to cloud provider relationship. The “Mobile Security” controls are built upon the CSA’s “Security Guidance for Critical Areas of Mobile Computing, v1.0” and are the first mobile device specific controls incorporated into the Cloud Control Matrix. The “Supply Change Management, Transparency and Accountability” control domain seeks to address risks associated with governing data within the cloud while the “Interoperability & Portability” brings to the forefront considerations to minimize service disruptions in the face of a change in a cloud vendor relationship or expansion of services. The realigned control domains have also benefited through changes in language to improve the clarity and intent of the control, and, in some cases, realigned within the expanded control domains to ensure the cohesiveness within each control domain and minimize overlap. The draft of the Cloud Control Matrix can be downloaded from the Cloud Security Alliance website and the CSA welcomes peer review through the CSA Interact website. https://interact.cloudsecurityalliance.org/index.php/ccm/v3_group_1 https://interact.cloudsecurityalliance.org/index.php/ccm/v3_group_2 https://interact.cloudsecurityalliance.org/index.php/ccm/v3_group_3 The CSA invites all interested parties to participate in the peer review and the CSA Cloud Controls Matrix Working Group Meeting to be held during the week of the RSA Conference, at 4pm PT on February 28, 2013, at the Sir Francis Drake Hotel
Franciscan Room
450 Powell St in San Francisco, CA.