CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | Zero Trust Privacy Assessment and Guidance - Korean Translation Release Date: 07/22/2025 This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | Healthcare Confidential Computing and the Trusted Execution Environment Release Date: 07/14/2025 Healthcare Delivery Organizations (HDOs) routinely process Protected Health Information (PHI), Personally Identifiable Information (PII), and financial da... Request to download |
 | Release Date: 07/09/2025 The AI Controls Matrix (AICM) is a first-of-its-kind vendor-agnostic framework for cloud-based AI systems. Organizations can use the AICM to develop, impl... Request to download |
 | CAVEaT Working Group Charter 2025 Release Date: 06/26/2025 The Cloud Security Alliance (CSA), in collaboration with the MITRE Corporation, established the Cloud Adversarial Vectors, Exploits, and Threats (CAVEaT™)... Request to download |
 | Navigating the Human Factor: Addressing Employee Resistance to AI Adoption Release Date: 06/25/2025 In boardrooms around the world, leaders are hailing artificial intelligence (AI) as a game-changer for efficiency and innovation. Many organizations have ... Request to download |
| Release Date: 06/20/2025 This document introduces Valid-AI-ted, CSA’s new AI-powered tool for evaluating STAR Level 1 self-assessments. Learn how the tool uses LLM technology to p... Request to download |
 | Zero Trust Automation & Orchestration and Visibility & Analytics Overview Release Date: 06/04/2025 Visibility & Analytics and Automation & Orchestration are foundational, cross-cutting capabilities within the Zero Trust paradigm. They enable con... Request to download |
 | Dynamic Process Landscape: A Strategic Guide to Successful AI Implementation Release Date: 06/02/2025 Artificial Intelligence (AI) adoption in business and manufacturing is failing at least twice as often as it succeeds. Companies are trying to integrate A... Request to download |
 | Release Date: 05/28/2025 Agentic AI systems represent a significant leap forward for AI. Their ability to plan, reason, act, and adapt autonomously introduces new capabilities and... Request to download |
 | Release Date: 05/27/2025 Traditional security models treat Internet of Things (IoT) security solely as a long-term supply chain concern. This is a significant oversight in today's... Request to download |
 | Top Threats to Cloud Computing - Deep Dive 2025 Release Date: 04/28/2025 This report uses the threats identified in CSA’s Top Threats to Cloud Computing 2024 to reflect on eight recent cybersecurity breaches. Notable incidents ... Request to download |
 | State of SaaS Security Report 2025 Release Date: 04/21/2025 Software-as-a-Service (SaaS) applications have become foundational to modern business operations. However, organizations are also facing a rising tide of ... Request to download |
 | Requirements for Bodies Providing STAR Certification Release Date: 03/31/2025 This document outlines how to conduct STAR certification assessments to the Cloud Controls Matrix (CCM) as part of an ISO 27001 assessment. The STAR certi... Request to download |
.png) | CSA Code of Conduct to EU Cloud Code of Conduct Mapping Release Date: 03/24/2025 Navigating General Data Protection Regulation (GDPR) compliance requirements can be challenging. Fortunately, Codes of Conduct (CoCs) provide a straightfo... Request to download |
 | Cloud Key Management Working Group Charter 2025 Release Date: 03/18/2025 Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using key management systems with thos... Request to download |
 | Release Date: 03/11/2025 Shadow Access is undesired or unauthorized access to resources, such as applications, networks, and data. Shadow Access is increasingly a cloud issue, res... Request to download |
 | The Six Pillars of DevSecOps Bundle Release Date: 03/10/2025 DevOps enhances the management of information security, but its execution must be secured to avoid vulnerabilities like lax firewall rules or default cred... Request to download |
 | Enterprise Authority To Operate (EATO) Auditing Guidelines Release Date: 03/05/2025 Now includes Auditing Guidelines!Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information securi... Request to download |
 | Understanding Data Security Risk Survey Report 2025 Release Date: 02/26/2025 Organizations face a rapidly changing threat landscape. The complexities of hybrid and multi-cloud environments are exposing new vulnerabilities and chall... Request to download |
 | Zero Trust Privacy Assessment and Guidance Release Date: 02/18/2025 When people discuss Zero Trust, they often focus on how it can help protect data across an organization. However, they tend to forget how it can also help... Request to download |