Cloud 101CircleEventsBlog
The CCSK v5 and Security Guidance v5 are now available!

CSA Research

Best practices, guidance, frameworks and tools to help the industry secure the cloud. Read our research to get your questions around cloud security answered.
Research

CSA Research is created by the industry for the industry and is both vendor-neutral and consensus driven. Our research is created by subject matter experts who volunteer for our working groups. Each working group focuses on a unique topic or aspect of cloud security, from IoT, DevSecOps, Serverless and more, we have working groups for over 20 areas of cloud computing. You can view a list of all active research working groups. To find out more about how our research is created and the process we follow you can view the CSA Research Lifecycle.

Contribute to CSA Research

Peer reviews allow security professionals from around the world to collaborate on CSA research. Provide your feedback on the following documents in progress.

Latest Research

AI Model Risk Management Framework

AI Model Risk Management Framework

Release Date: 07/23/2024

Sophisticated machine learning (ML) models present exciting opportunities in fields such as predictive maintenance and smart supply chain management. While these ML models hold the potential to unlock significant innovation, their increasing use also introduces inherent risks. Unaddressed model...
Security Guidance for Critical Areas of Focus in Cloud Computing v5

Security Guidance for Critical Areas of Focus in Cloud Computing v5

Release Date: 07/15/2024

Cloud computing has firmly cemented its place as the foundation of the information security industry. The Cloud Security Alliance’s Security Guidance v5 is professionals' go-to resource for understanding modern cloud components and cloud security best practices. Balancing foundational knowledge...
Enterprise Authority To Operate (EATO) Controls Framework

Enterprise Authority To Operate (EATO) Controls Framework

Release Date: 07/02/2024

Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information security controls. These security gaps particularly discourage corporate customers that operate in highly regulated industries. Customers in these industries must individually...