CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | CCM-Lite and CAIQ-Lite The Cloud Security Alliance, in collaboration with the CCM Working Group, proudly presents the CCM-Lite and CAIQ-Lite File Bundle. These tools offer a str... Request to download |
 | Machine Identity in Cybersecurity and IAM Identity management is a crucial aspect of information security, as it ensures that only authorized individuals and entities have access to sensitive data... Request to download |
 | Defining Shadow Access: The Emerging IAM Security Challenge Shadow Access is the unmonitored, unauthorized, invisible, unsafe and generally over-permissioned access in your cloud environment. In short, the unintend... Request to download |
 | Guidelines for CPAs Providing CSA STAR Attestation v4 This document provides guidance for CPAs in conducting a STAR Attestation. It includes relevant information including professional requirements, competenc... Request to download |
 | STAR Program Overview The CSA Security, Trust, Assurance, and Risk (STAR) program is the most complete and largest cloud assurance program in the world that constitutes an ecos... Request to download |
.png) | FaaS Serverless Control Framework (Set) based on NIST 800-53 R5 controls This spreadsheet provides a cybersecurity control framework for Function-as-a-Service (FaaS) serverless deployments. The framework is based on the NIST 80... Request to download |
 | Identity and Access Management Glossary The Identity and Access Management (IAM) Glossary is a reference document that aggregates and summarizes IAM-related terms and definitions. Bringing toget... Request to download |
 | Data Security Working Group Charter 2023 The Data Security working group’s goal is to provide a forum for the cybersecurity community on issues related to data security, data governance, privacy,... Request to download |
 | Cloud Native Application Protection Platform Survey Report Cloud Native Application Protection Platforms (CNAPPs) have emerged as a critical category of security tooling in recent years due to the complexity of co... Request to download |
-1.png) | International Standardization Council Charter 2023 This charter lays out the scope, responsibilities, and roadmap for the International Standardization Council (ISC). The ISC actively searches mechanisms o... Request to download |
| CSA Assurance Education FAQ Assurance education encompasses training and certification programs that teach individuals how to determine the effectiveness of the cybersecurity practic... Request to download |
| STAR Assessment Portfolio FAQ The STAR Assessment Portfolio is a collection of globally-recognized cloud security and privacy assessments that can be completed by cloud service provide... Request to download |
 | State of SaaS Security: 2023 Survey Report - Japanese Translation This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | Security Implications of ChatGPT - Korean Translation This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | Security Enabled Innovation and Cloud Trends Expel commissioned CSA to develop a survey and report to understand better the industry’s knowledge, attitudes, and opinions regarding security’s relation... Request to download |
 | Security Implications of ChatGPT This position paper provides analysis across four dimensions: How it can benefit cybersecurity, how it can benefit malicious attackers, how ChatGPT might ... Request to download |
 | Serverless Working Group Charter 2023 The Serverless Working Group seeks to develop best practices to help organizations that want to run their business with a serverless computing model. Serv... Request to download |
.jpg) | Zero Trust Guiding Principles Zero Trust is a strategic mindset that is highly useful for organizations to adopt as part of their digital transformations and other efforts to increase ... Request to download |
.jpg) | Zero Trust Principles and Guidance for Identity and Access Management (IAM) Identity and the ability to consume information about that identity as well as other Zero Trust (ZT) signals (additional attributes about an identity), is... Request to download |
 | What is IAM for the Cloud? The purpose of this document is to provide an understanding of the challenges and considerations involved in managing Identity and Access Management (IAM)... Request to download |