Download Publication

Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information security controls. These security gaps particularly discourage corporate customers that operate in highly regulated industries. Customers in these industries must individually assess XaaS cloud services using heavy-weight cloud control assessments, incurring a significant cost and resulting in complex remediation requirements for the vendor.

With hopes to solve this problem, CSA has created the Enterprise Authority to Operate (EATO) Controls Framework. Created by the EATO Working Group, this framework helps identify and remediate risks in cloud-based XaaS services. Use of the framework allows large corporate clients to more easily accept small and mid-sized vendors.

The framework contains 163 controls based on CSA’s Cloud Controls Matrix (CCM) v4. Information security, BCDR, data retention, archiving, vendor risk, and privacy controls are all included. Compared to CCM, the EATO Controls Framework contains more detailed and additional core controls. These controls apply stricter requirements that cater to the needs of highly regulated corporate customers. To compensate for the additional controls, the framework also shortens and drops certain peripheral controls that are included in CCM.