ISF to Map its “Standard of Good Practice” with Cloud Security Alliance Controls Matrix

Responding rapidly to mounting risks with ready-made frameworks of security controls designed to mitigate known and unknown threats and challenges

LONDON – April 18, 2023: The Information Security Forum (ISF), an independent, not‑for‑profit cybersecurity association with 500+ corporate members, today announced it has partnered with the Cloud Security Alliance (CSA) to develop a cross reference between ISF’s “Standard of Good Practice” for information security (SOGP) and the CSA Cloud Controls Matrix. CSA is the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment.

This newly released cross reference can help security professionals leverage the two resources and deploy effective controls across their cloud environments. The SOGP framework incorporates some of the leading industry standards (e.g., NIST; ISO/IEC 27002, CSA Cloud Controls Matrix) helping organisations integrate resilience and guiding them to better cybersecurity practices.

The CSA Cloud Controls Matrix (CCM) is a widely adopted framework used as a tool for the systematic assessment of cloud implementations, providing guidance on which security controls should be implemented by which actor within the cloud supply chain. The Matrix is aligned to the CSA Security Guidance for Cloud Computing and considered a de-facto standard for cloud security assurance and compliance.

SOGP presents business-orientated cybersecurity guidance and up-to-date best practices involving all aspects of cyber resilience, cloud security, and information risk management. Principle cybersecuity strategies of SOGP include:

• Responding rapidly to mounting threats with a ready-made framework of security controls
• Assessing information risk and delivering comprehensive, consistent protection
• Managing supply chains with a risk‑based approach to information security
• Ensuring regulatory compliance in an efficient, cost-effective manner
• Consolidating security policies and procedures, with structure and content that can be rapidly adopted
• Raising employee security awareness and education

Says ISF Chief Executive Steve Durbin, “SOGP is designed for risk management specialists, information security managers and security practitioners to be more agile and responsive to rapidly evolving threats while avoiding costly incidents, operational impacts and reputational damage.”

“A primary goal of the Cloud Security Alliance is to extend the connections between Cloud Controls Matrix and other frameworks through mapping to help the ecosystem develop a common vocabulary and language when it comes to cloud security,” says Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance. “The mapping between the ISF SOGP and the CCM v4 connects two of the leading security frameworks and enables ISF Members to look at their SOGP-based approach through the cloud lenses provided by CSA’s CCM.”

A joint webinar between ISF and CSA will air April 18:

https://www.securityforum.org/attend/using-the-sogp-and-ccm-for-multi-cloud-security/

For more information on SOGP visit:

https://www.securityforum.org/solutions-and-insights/standard-of-good-practice-for-information-security/

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.

About the Information Security Forum
Founded in 1989, the ISF is a leading authority on information security and risk management. A not‑for‑profit organization, ISF provides independent opinion and guidance on all aspects of information security, delivering practical solutions to overcome the wide‑ranging information security and risk management challenges that impact organizations of all sizes. For further information, visit www.securityforum.org.

Media Contact:
June Chambers
Head of PR and Corporate Communications
+44 (0)7825 187778
[email protected]