Cloud 101CircleEventsBlog
Join top cybersecurity experts at the Raleigh, NC LevelBlue's cyber networking event June 20th!

Publication Peer Review

Enterprise Authority To Operate (EATO) Controls Framework
Enterprise Authority To Operate (EATO) Controls Framework

Enterprise Authority To Operate (EATO) Controls Framework

Open Until: 05/12/2024

The Enterprise Authority To Operate (EATO) working group is opening their Controls Framework for open peer review.


Background: Why?

  • The CSA Enterprise Authority to Operate (EATO) Working Group has identified gaps in the understanding and implementation of information security and data protection controls by small—to mid-sized cloud-based XaaS, particularly when processing sensitive data of highly regulated industries, inhibiting market adoption of such services.
  • For consuming Corporate Customers who have to abide by multiple and tight regulations, such Cloud-based XaaS cannot be adopted "out of the box" but has to be assessed individually (i.e., by each potential customer) using heavy-weight Risk and Cloud Control Assessments.
  • These assessments result in many findings regarding control deficiencies. The findings lead to complex remediation requirements for the vendor and their services.
  • Overall, this is a significant and redundant cost with multiple and potentially also overlapping or even conflicting effort-intensive assessments and remediation processes, both to the vendor and to several potential Corporate Customers.

Objectives: What?

  • EATO targets identifying and remediating risks resulting from control failures inherent in XaaS products with underlying cloud-based infrastructure or platforms.
  • The controls assessed relate to information security and privacy, Business Continuity, Data Retention, Archiving, and vendor/service provider controls and risks.
  • Establish an industry-standard controls and assessment framework for XaaS catering to customer firms in highly regulated industries.
  • Controls are based on CCMv4, but they are tailored:
  • Core controls have been sharpened to apply stricter and more detailed information security compliance requirements and evidencing scrutiny, catering to the needs of highly regulated corporate customers.
  • Some controls have been added compared to CCMv4 where necessary for highly regulated corporate customers.
  • Other controls have been combined/collapsed to reduce the assessment's load on the XaaS providers and focus on compliance with Core Controls.
  • A small number of controls existing in CCMv4 have been dropped, again to focus on compliance with Core Controls.
  • Establish a global, trusted independent assessment service for small and mid-sized Cloud-based XaaS providers against the industry standard enhanced controls framework. 
  • Establish a trusted and independently certified remediation consultancy service that enables XaaS Providers to change the design of their services and implement security by design.

Approach: How?

  • Provide a trusted certification to subscribing firms enabling to reduce cost and risk.
  • Improvement of information security by design across XaaS Providers: 
  • By incentivizing to conduct an assessment, and only one instead of many 
  • Reducing cost for XaaS Providers for the assessment 
  • Focusing efforts on remediation against one central / combined set of findings instead of many disparate and potentially conflicting requirements 
  • Efficiency gains for Subscribing Firms as there is only one central assessment instead of one each per firm wanting to use the XaaS Providers’ services 
  • Reduction of cost and effort for Subscribing Firms using a shared trusted assessment 
  • Globally accepted and trusted Certificate that also covers effective remediation performed and validated.

Peer review period has ended.