CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | Zero Trust Guiding Principles v1.1 Zero Trust is a strategic mindset that is highly useful for organizations to adopt as part of their digital transformations. Based on the idea of "never t... Request to download |
%20Charter%202024-01.png) | Data Privacy Engineering Working Group Charter 2024 The Data Privacy Engineering Working Group (DPE WG) is chartered with the mission to integrate privacy-centric methodologies into development workflows, a... Request to download |
 | Fully Homomorphic Encryption Working Group Charter 2024 Through the use and deployment of cryptographic libraries, specialist software toolchains, and dedicated hardware and infrastructure, Fully Homomorphic En... Request to download |
 | Securing LLM Backed Systems: Essential Authorization Practices Organizations are increasingly leveraging Large Language Models (LLMs) to tackle diverse business problems. Both existing companies and a crop of new star... Request to download |
 | Strengthening Research Integrity with High-Performance Computing (HPC) Security High-Performance Computing (HPC) systems aggregate computing resources to gain performance greater than that of a single workstation. HPC systems have bec... Request to download |
 | Using AI for Offensive Security Offensive security involves proactively simulating an attacker’s behavior by using tactics and techniques similar to those of an adversary to identify sys... Request to download |
 | Top Threats to Cloud Computing 2024 The CSA Top Threats Report aims to raise awareness of current cloud security risks, threats, and vulnerabilities. In this 2024 installment, we surveyed ov... Request to download |
 | Quantum-Safe Security Governance with the Cloud Controls Matrix For the last decade or so there have been major developments in the quantum and post-quantum cryptography spaces. The time has come for enterprise IT depa... Request to download |
 | AI Model Risk Management Framework Sophisticated machine learning (ML) models present exciting opportunities in fields such as predictive maintenance and smart supply chain management. Whil... Request to download |
 | Security Guidance for Critical Areas of Focus in Cloud Computing v5 Cloud computing has firmly cemented its place as the foundation of the information security industry. The Cloud Security Alliance’s Security Guidance v5 i... Request to download |
%20Controls%20Framework%20Thumbnail.png) | Enterprise Authority To Operate (EATO) Controls Framework Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information security controls. These security gaps ... Request to download |
 | SaaS Governance Best Practices for Cloud Customers - Korean Translation This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | CCM Lite and CAIQ Lite v4 - Japanese Translation This localized version of this publication was produced from the original source material (CCM Lite and CAIQ Lite) through the efforts of chapters and vol... Request to download |
 | CSA Large Language Model (LLM) Threats Taxonomy This document aims to align the industry by defining key terms related to Large Language Model (LLM) risks and threats. Establishing a common language red... Request to download |
 | CCM-Lite and CAIQ-Lite The Cloud Security Alliance, in collaboration with the CCM Working Group, proudly presents the CCM-Lite and CAIQ-Lite File Bundle. These tools offer a str... Request to download |
 | The Annual SaaS Security Survey Report 2025 Plans and Priorities In 2024, Software-as-a-Service (SaaS) platforms are integral to most businesses. Unfortunately, inventive threat actors regularly breach SaaS applications... Request to download |
 | CCM v4.0 Implementation Guidelines This document will help you understand how to navigate through the Cloud Controls Matrix v4 to use it effectively and interpret and implement the CCM cont... Request to download |
 | Cloud Controls Matrix and CAIQ v4 The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing aligned to the CSA best practices, that is considered the de-facto s... Request to download |
 | CCM Machine Readable Bundle (JSON/YAML/OSCAL) CSA provides in a machine-readable format the CCM Controls, CAIQ Security Questionnaire, Implementation Guidelines (both JSON/YAML and OSCAL) and Mappings... Request to download |
 | Identity and Access Management Working Group Charter 2024 Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using Identity Access Management (IAM)... Request to download |