CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | The State of Non-Human Identity Security Non-human identities (NHIs) include bots, API keys, service accounts, OAuth tokens, and secrets. These identities keep today’s organizations running smoot... Request to download |
 | Confidential Computing Working Group Charter 2024 The working group is tasked with exploring and implementing Confidential Computing technologies to enhance data security across various industries. This g... Request to download |
 | Zero Trust Guiding Principles v1.1 Zero Trust is a strategic mindset that is highly useful for organizations to adopt as part of their digital transformations. Based on the idea of "never t... Request to download |
 | Strengthening Research Integrity with High-Performance Computing (HPC) Security High-Performance Computing (HPC) systems aggregate computing resources to gain performance greater than that of a single workstation. HPC systems have bec... Request to download |
 | Top Threats to Cloud Computing 2024 The CSA Top Threats Report aims to raise awareness of current cloud security risks, threats, and vulnerabilities. In this 2024 installment, we surveyed ov... Request to download |
 | Quantum-Safe Security Governance with the Cloud Controls Matrix For the last decade or so there have been major developments in the quantum and post-quantum cryptography spaces. The time has come for enterprise IT depa... Request to download |
%20Controls%20Framework%20Thumbnail.png) | Enterprise Authority To Operate (EATO) Controls Framework Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information security controls. These security gaps ... Request to download |
 | SaaS Governance Best Practices for Cloud Customers - Korean Translation This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | CCM v4.0 Implementation Guidelines This document will help you understand how to navigate through the Cloud Controls Matrix v4 to use it effectively and interpret and implement the CCM cont... Request to download |
 | Cloud Controls Matrix and CAIQ v4 The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing aligned to the CSA best practices, that is considered the de-facto s... Request to download |
 | Identity and Access Management Working Group Charter 2024 Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using Identity Access Management (IAM)... Request to download |
 | Information Technology Governance, Risk, and Compliance in Healthcare v2 Healthcare organizations are increasingly using cloud services. However, the transition to the cloud presents many Governance, Risk, and Compliance (GRC) ... Request to download |
 | The Six Pillars of DevSecOps: Measure, Monitor, Report, and Action The implementation and maintenance of DevSecOps initiatives can take anywhere from a few months to several years to implement. Therefore, continuous measu... Request to download |
 | HSM-as-a-Service Use Cases, Considerations, and Best Practices A Hardware Security Module (HSM) is a certified, trusted platform for performing cryptographic operations and protecting keys. It is a tamper-responsive a... Request to download |
 | Defining the Zero Trust Protect Surface Enterprise adoption and implementation of Zero Trust is broad and growing. Venture Beat reports that 90% of organizations moving to the cloud are adopting... Request to download |
 | The Six Pillars of DevSecOps - Collaboration and Integration “Security can only be achieved through collaboration, not confrontation” is one of the defining principles of DevSecOps. Essentially, security is a team s... Request to download |
 | The State of Security Remediation 2024 Security remediation involves identifying, evaluating, and addressing security vulnerabilities to mitigate potential risks. In the ever-evolving landscape... Request to download |
 | Top Threats Working Group Charter 2024 The Top Threats Working Group aims to provide up-to-date, industry-informed expert insights on cloud security risks, threats, and vulnerabilities to help ... Request to download |
 | Health Information Management Working Group Charter 2024 The Health Information Management Working Group aims to directly influence how health information service providers deliver secure cloud solutions (servic... Request to download |
 | CSA Data Security Glossary This CSA Data Security Glossary identifies and defines 127 terms relevant to data security. Based on the CSA Cloud Security Glossary, NIST Glossary, and o... Request to download |