CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | The Six Pillars of DevSecOps - Collaboration and Integration “Security can only be achieved through collaboration, not confrontation” is one of the defining principles of DevSecOps. Essentially, security is a team s... Request to download |
 | The State of Security Remediation 2024 Security remediation involves identifying, evaluating, and addressing security vulnerabilities to mitigate potential risks. In the ever-evolving landscape... Request to download |
 | Top Threats Working Group Charter 2024 The Top Threats Working Group aims to provide up-to-date, industry-informed expert insights on cloud security risks, threats, and vulnerabilities to help ... Request to download |
 | Health Information Management Working Group Charter 2024 The Health Information Management Working Group aims to directly influence how health information service providers deliver secure cloud solutions (servic... Request to download |
 | CSA Data Security Glossary This CSA Data Security Glossary identifies and defines 127 terms relevant to data security. Based on the CSA Cloud Security Glossary, NIST Glossary, and o... Request to download |
 | Key Management Lifecycle Best Practices Cryptographic keys are essential for securing digital assets, yet managing these keys can be challenging for organizations that run applications in the cl... Request to download |
 | Communicating the Business Value of Zero Trust Zero Trust is a major industry trend that is being adopted and promoted by security teams around the globe, and for good reason - it delivers improved sec... Request to download |
 | How to Design a Secure Serverless Architecture As businesses work to bring technology value to market faster, serverless computing is gaining adoption with developers. Serverless platforms enable devel... Request to download |
 | Top Threats to Cloud Computing: Pandemic 11 Deep Dive This publication reflects on eight recent cloud breach cases, presented as both a detailed narrative and a threat model. The threat model format provides ... Request to download |
 | Data Loss Prevention in Healthcare The rise of digital services in healthcare has made protecting medical data an ongoing challenge. Data loss may occur in several forms, including informat... Request to download |
.png) | FaaS Serverless Control Framework (Set) based on NIST 800-53 R5 controls This spreadsheet provides a cybersecurity control framework for Function-as-a-Service (FaaS) serverless deployments. The framework is based on the NIST 80... Request to download |
 | Identity and Access Management Glossary The Identity and Access Management (IAM) Glossary is a reference document that aggregates and summarizes IAM-related terms and definitions. Bringing toget... Request to download |
 | Data Security Working Group Charter 2023 The Data Security working group’s goal is to provide a forum for the cybersecurity community on issues related to data security, data governance, privacy,... Request to download |
 | Cloud Native Application Protection Platform Survey Report Cloud Native Application Protection Platforms (CNAPPs) have emerged as a critical category of security tooling in recent years due to the complexity of co... Request to download |
-1.png) | International Standardization Council Charter 2023 This charter lays out the scope, responsibilities, and roadmap for the International Standardization Council (ISC). The ISC actively searches mechanisms o... Request to download |
 | Top Threats to Cloud Computing Post Pandemic Eleven Survey Report The CSA Top Threats Report aims to raise awareness of current cloud security risks, threats, and vulnerabilities. In this 2024 installment, we surveyed ov... Request to download |
.jpg) | Zero Trust Principles and Guidance for Identity and Access Management (IAM) Identity and the ability to consume information about that identity as well as other Zero Trust (ZT) signals (additional attributes about an identity), is... Request to download |
 | What is IAM for the Cloud? The threat landscape has materially changed over the years to the point that Identity and Access Management (IAM) is a core component of any digital acces... Request to download |
 | Cloud and Compromise (C&C): Gamifying of Cloud Security CSA’s Top Threats Working Group works to identify the most significant cloud security threats, vulnerabilities, and weaknesses; analyze major incidents; a... Request to download |
 | CSA Code of Conduct Gap Resolution and Annex 10 to the CSA Code of Conduct for GDPR Compliance This bundle from the CSA Privacy Level Agreement Working Group includes:CSA Code of Conduct Gap Resolution spreadsheetAnnex 10 to the CSA Code of Conduct ... Request to download |