Industry Insights

Read the latest cloud security news, trends, and thought leadership from subject matter experts.

Industry Insights
Understanding Compliance
Published: 09/28/2021

This blog was originally published by CyberCrypt here.Tip: Don’t treat compliance merely as a checklist. Use the process as an audit of your security controls. Put security first: Build security around your threat model and then confirm that you are compliant.As regulators demand stricter securit...

The Adoption of Multi-Cloud Drives the Need for Better Data Protection and Management of Encryption Keys and Policy Controls
Published: 09/17/2021

This blog was originally published by Entrust here.Written by Jim DeLorenzo, Entrust.Enterprise adoption of multiple cloud platforms continues in earnest, whether it’s aimed at improving collaboration, reducing datacenter footprint, increasing customer response times or any number of other busine...

STAR Testimonial: CSA STAR + SOC2 - From Readiness to Attestation
Published: 08/20/2021

CSA’s STAR Attestation is the first cloud-specific attestation program designed to quickly assess and understand the types and rigor of security controls applied by cloud service providers. This is a collaboration between CSA and the AICPA to provide guidelines for CPAs to conduct SOC2 engageme...

CCM Testimonial: The Advantages and Future of the Cloud Controls Matrix
Published: 08/12/2021

The Cloud Controls Matrix (CCM) is composed of 197 control objectives that cover all key aspects of cloud technology. It can be used as a tool for the systematic assessment of cloud implementation and provides guidance on which security controls should be implemented by which actor within the clo...

How is CSA STAR Different From ISO 27001 and SOC 2?
Published: 08/02/2021

The STAR Registry lists cloud solution providers and security providers that have earned a cloud compliance certification from CSA or submitted a cloud security self-assessment questionnaire. While STAR Level 1 is a basic Yes/No or N/A question set to self-declare your compliance with the Cloud C...

Scaling GRC Programs: 5 Ways Security Leaders Enable the Business
Published: 07/19/2021

This blog was originally published by OneTrust GRC here.The compliance landscape is in constant flux between external factors changing and businesses working toward scaling GRC programs. Managing compliance is difficult for organizations operating across multiple geographies with multiple sets of...

Cloud Security: 5 Lessons I Learned the Hard Way
Published: 07/09/2021

This blog was originally published by OpsCompass hereWritten by John Grange, OpsCompassIt’s 2021, and it’s clear that cloud is a global IT trend relevant to every company, regardless of size or industry. The main cloud infrastructure providers (AWS, Azure, and GCP), as well as their local alterna...

​CCSK Success Stories: From a Cloud Trust Associate
Published: 06/17/2021

This is part of a blog series interviewing cybersecurity professionals who have earned their Certificate of Cloud Security Knowledge (CCSK). In these blogs we invite individuals to share some of the challenges they face in managing security for cloud computing and how they were able to leverage k...

How to Enhance GRC Program Collaboration in Your Organization
Published: 06/10/2021

This blog was originally published by OneTrust GRC here. When it comes to Governance, Risk, and Compliance (GRC), understanding the integrated risk management responsibilities for each internal and external stakeholder isn’t just a best practice. It’s a critical component to preparing for and ...

The STAR Certification Journey
Published: 06/08/2021

The CSA STAR Program is a powerful tool for security assurance in the cloud. It encompasses key principles of transparency, rigorous auditing, and harmonization of standards. Companies who use STAR indicate best practices and validate the security posture of their cloud offerings. The CSA Securit...

CAIQ v4 Released - Changes from v3.1 to v4
Published: 06/07/2021
Author: Daniele Catteddu

This blog was updated on 8/16/21 with the news that organizations can now submit CAIQ v4 to the STAR Registry.Since the publication of CCM v4 in January 2021, CSA has initiated a process to upgrade CAIQ, the questionnaire associated with CCM. In this blog we will explain changes made to version 4...

How CSPs Can Make the Security and Compliance Evaluation Process Easier for Financial Institutions
Published: 06/02/2021

This blog was originally published by Oracle hereOracle author: Maywun Wong, Director, Product MarketingContributed by: Steven D'Alfonso, Research Director, IDC Financial InsightsSo, you have finally decided to move applications to the cloud. But your board's risk committee wants assurance that s...

CCAK Testimonials: From a Cybersecurity Principal
Published: 05/28/2021

The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. The CCAK credential and training program fills the gap in the market for technical educat...

The Shift to Eight-Digit BINs
Published: 05/14/2021

This blog was originally published by TokenEx hereWritten by Branden Morrow, TokenExThere is a lot of information going around about an eight-digit BIN mandate, and we wanted to give some clarity on what a BIN is, why it is important, how it relates to PCI DSS compliance, why a shift to an eight-...

CCAK Testimonials: From an Audit and Compliance Expert
Published: 05/13/2021
Author: Michael Roza

The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. The CCAK credential and training program fills the gap in the market for technical educat...

CCAK Testimonials: From a Cloud Security Expert
Published: 05/06/2021
Author: Moshe Ferber

The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. The CCAK credential and training program fills the gap in the market for technical educat...

What an Auditor Should Know about Cloud Computing Part 3
Published: 04/27/2021
Author: Moshe Ferber

With the launch of the Certificate of Cloud Auditing Knowledge (CCAK) credential by ISACA and CSA, Moshe Ferber has put together some of the insights gained during the creation of the CCAK. This is the third in a series of three blogs dealing with the essentials an auditor needs to know about clo...

CCAK Testimonials: From a Cybersecurity Architect
Published: 04/22/2021

The Certificate of Cloud Auditing Knowledge (CCAK) is the first credential available for industry professionals to demonstrate their expertise in the essential principles of auditing cloud computing systems. The CCAK credential and training program fills the gap in the market for technical educat...

Introduction to the NIST Cybersecurity Framework
Published: 04/21/2021

This blog was originally published by OpsCompass hereWritten by Kevin Hakanson, OpsCompassSecurity Framework Based on Standards, Guidelines, and PracticesThe NIST Cybersecurity Framework (NIST CSF) was created via a collaboration between the United States government and industry as a voluntary fr...

What an Auditor Should Know about Cloud Computing Part 2
Published: 04/20/2021

Deep Dive into Cloud GovernanceWith the launch of the Certificate of Cloud Auditing Knowledge (CCAK) credential by ISACA and CSA, Moshe Ferber has put together some of the insights gained during the creation of the CCAK. This is the second in a series of three blogs dealing with the essentials an...

Browse by Topic
Write for the CSA blog
Submit your blog proposal