Cloud 101CircleEventsBlog
Missed CSA's Cyber Monday sale? You can still get 50% off the CCSK + CCZT Exam & Training Bundle and Token Bundle with raincheck code 'rcdoubledip24'

Download Publication

CSA Enterprise Architecture Reference Guide
CSA Enterprise Architecture Reference Guide
Who it's for:
  • Cybersecurity architects
  • Cloud engineers
  • Cloud security professionals
  • Compliance professionals

CSA Enterprise Architecture Reference Guide

Release Date: 05/18/2021

The CSA Enterprise Architecture (EA) is both a methodology and a set of tools. It is a framework, a comprehensive approach for the architecture of a secure cloud infrastructure, and can be used to assess opportunities for improvement, create roadmaps for technology adoption, identify reusable security patterns, and assess various cloud providers and security technology vendors against a common set of capabilities.

To create the CSA Enterprise Architecture, the EA Working Group leveraged four industry standard architecture models: TOGAF, ITIL, SABSA, and Jericho, therefore combining the best of breed architecture paradigms into a comprehensive approach to cloud security. By merging business drivers with security infrastructure, the EA increases the value proposition of cloud services within an enterprise business model. The CSA Enterprise Architecture was adopted by the National Institute of Standards and Technologies in NIST SP 500-299 and NIST SP 500-292.

This guide is your deep dive into each EA domain. For quick reference and a visual representation of these domains, refer to the Enterprise Architecture Reference Diagram.

To learn how the EA maps to CSA’s standard controls set, refer to the Enterprise Architecture v2 to CCM v3.01 Mapping

Key Takeaways:
  • What the CSA Enterprise Architecture is.
  • How to use the CSA Enterprise Architecture.
  • The full explanation of each EA domain, the specifics of each of their components, how to apply them to your organization, and their relationships to the other domains. 
  • The EA domains are:
    • Business Operation Support Services (BOSS)
    • Information Technology Operation and Support (ITOS)
    • Technology Solution Services (TSS)
    • Security and Risk Management (SRM)

Download this Resource

Bookmark
Share
View translations
Related resources
Map the Transaction Flows for Zero Trust
Map the Transaction Flows for Zero Trust
Top Concerns With Vulnerability Data
Top Concerns With Vulnerability Data
Using Asymmetric Cryptography to Help Achieve Zero Trust Objectives
Using Asymmetric Cryptography to Help Achieve Z...
Strengthening Cybersecurity with a Resilient Incident Response Plan
Strengthening Cybersecurity with a Resilient Incident Response Plan
Published: 12/10/2024
Microsoft Power Pages: Data Exposure Reviewed
Microsoft Power Pages: Data Exposure Reviewed
Published: 12/09/2024
Why Continuous Controls Monitoring is Not GRC: Transforming Compliance and Risk Management
Why Continuous Controls Monitoring is Not GRC: Transforming Complia...
Published: 12/09/2024
AI-Enhanced Penetration Testing: Redefining Red Team Operations
AI-Enhanced Penetration Testing: Redefining Red Team Operations
Published: 12/06/2024

Acknowledgements

Michael Roza
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC

Michael Roza

Risk, Audit, Control and Compliance Professional at EVC

Since 2012, Michael Roza has been a pivotal member of the Cloud Security Alliance (CSA) family. He has contributed to over 125 projects, as a Lead Author or Author/Contributor and many more as a Reviewer/Editor.

Michael's extensive contributions encompass critical areas including Artificial Intelligence, Zero Trust/Software Defined Perimeter, Internet of Things, Top Threats, Cloud Control Matrix, DevSecOps, and Key Management. His lea...

Read more

Shawn Harris
Shawn Harris
Director of Information Security

Shawn Harris

Director of Information Security

With more than 25 years of information security experience, Shawn Harris is currently the Director of Information Security at Starbucks Coffee Company. His background includes engineering, architecture, and executive responsibilities. Shawn is currently co-chair of the CSA Cloud Controls Matrix working group, where he led efforts to develop the Cloud Control Matrix 4.0. Additionally, he has served on CSA’s Consensus Assessments ...

Read more

Jon-Michael Brook
Jon-Michael Brook

Jon-Michael Brook

Jon-Michael C. Brook is a certified, 25-year practitioner of cybersecurity, cloud, and privacy. He is the principal contributor to certification sites for privacy and cloud security, and has published books on privacy. Jon-Michael received numerous awards and recognition during his time with Raytheon, Northrop Grumman, Symantec, and Starbucks. He holds patents and trade secrets in intrusion detection, GUI design, and semantic data redaction...

Read more

Dr. Yale Li
Dr. Yale Li

Dr. Yale Li

Yale Li was a Microsoft’s Principal Security Architect responsible for data security, applications development security, and emerging market security in SAFE-T (Security Accelerator for Emerging Technologies) team. Yale was Graduate Education Partner at the Center of Information Assurance and Cyber Security at the University of Washington, and CEO’s Advisor of multiple Microsoft partner companies. As a security professional, Yale worked on ...

Read more

Ashish Vashishtha
Ashish Vashishtha
Security Compliance Leader

Ashish Vashishtha

Security Compliance Leader

Analytical, results-oriented IS/IT Audit, Governance, Risk, and Compliance (GRC) leader over 19 years of experience managing enterprise-wide IT/IS security risk approach for large healthcare and IT services organizations. Passionate design thinker with an ability to harness innovation by facilitating collaboration to develop enterprise-wide security risk assessments (onsite as well as remote) for high-risk Third-Parties leveraging NIST 800-...

Read more

Rolando Marcelo Vallejos Headshot Missing
Rolando Marcelo Vallejos

Rolando Marcelo Vallejos

Suri Venkat Headshot Missing
Suri Venkat

Suri Venkat

John Yeoh
John Yeoh
Global Vice President of Research, CSA

John Yeoh

Global Vice President of Research, CSA

With over 15 years of experience in research and technology, John excels at executive-level leadership, relationship management, and strategy development. He is a published author, technologist, and researcher with areas of expertise in cybersecurity, cloud computing, information security, and next generation technology (IoT, Big Data, SecaaS, Quantum). John specializes in risk management, third party assessment, GRC, data protection, incid...

Read more

Jim Reavis
Jim Reavis
Co-founder and Chief Executive Officer, CSA

Jim Reavis

Co-founder and Chief Executive Officer, CSA

For over 30 years, Jim Reavis has worked in cybersecurity industry as an entrepreneur, writer, speaker, technologist and business strategist. Jim’s innovative thinking about emerging trends have been published and presented widely throughout the industry and have influenced many.
Jim launched Cloud Security Alliance (CSA) in 2009 and has led its global growth and position as among the most vital cybersecurity communities worldwide. Under...

Read more

Michael Theriault Headshot Missing
Michael Theriault

Michael Theriault

Sean Heide
Sean Heide
Technical Research Director, CSA

Sean Heide

Technical Research Director, CSA

Henry Werchan Headshot Missing
Henry Werchan

Henry Werchan

Sunil Shanthi Headshot Missing
Sunil Shanthi

Sunil Shanthi

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?

Related Certificates & Training