CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
%20Controls%20Framework%20Thumbnail.png) | Enterprise Authority To Operate (EATO) Controls Framework Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information security controls. These security gaps ... Request to download |
 | SaaS Governance Best Practices for Cloud Customers - Korean Translation This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | CCM v4.0 Implementation Guidelines This document will help you understand how to navigate through the Cloud Controls Matrix v4 to use it effectively and interpret and implement the CCM cont... Request to download |
 | Cloud Controls Matrix and CAIQ v4 The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing aligned to the CSA best practices, that is considered the de-facto s... Request to download |
 | Identity and Access Management Working Group Charter 2024 Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using Identity Access Management (IAM)... Request to download |
 | Information Technology Governance, Risk, and Compliance in Healthcare v2 Healthcare organizations are increasingly using cloud services. However, the transition to the cloud presents many Governance, Risk, and Compliance (GRC) ... Request to download |
 | The Six Pillars of DevSecOps: Measure, Monitor, Report, and Action The implementation and maintenance of DevSecOps initiatives can take anywhere from a few months to several years to implement. Therefore, continuous measu... Request to download |
 | HSM-as-a-Service Use Cases, Considerations, and Best Practices A Hardware Security Module (HSM) is a certified, trusted platform for performing cryptographic operations and protecting keys. It is a tamper-responsive a... Request to download |
 | Defining the Zero Trust Protect Surface Enterprise adoption and implementation of Zero Trust is broad and growing. Venture Beat reports that 90% of organizations moving to the cloud are adopting... Request to download |
 | The Six Pillars of DevSecOps - Collaboration and Integration “Security can only be achieved through collaboration, not confrontation” is one of the defining principles of DevSecOps. Essentially, security is a team s... Request to download |
 | The State of Security Remediation 2024 Security remediation involves identifying, evaluating, and addressing security vulnerabilities to mitigate potential risks. In the ever-evolving landscape... Request to download |
 | Top Threats Working Group Charter 2024 The Top Threats Working Group aims to provide up-to-date, industry-informed expert insights on cloud security risks, threats, and vulnerabilities to help ... Request to download |
 | Health Information Management Working Group Charter 2024 The Health Information Management Working Group aims to directly influence how health information service providers deliver secure cloud solutions (servic... Request to download |
 | CSA Data Security Glossary This CSA Data Security Glossary identifies and defines 127 terms relevant to data security. Based on the CSA Cloud Security Glossary, NIST Glossary, and o... Request to download |
 | Key Management Lifecycle Best Practices Cryptographic keys are essential for securing digital assets, yet managing these keys can be challenging for organizations that run applications in the cl... Request to download |
 | Communicating the Business Value of Zero Trust Zero Trust is a major industry trend that is being adopted and promoted by security teams around the globe, and for good reason - it delivers improved sec... Request to download |
 | How to Design a Secure Serverless Architecture As businesses work to bring technology value to market faster, serverless computing is gaining adoption with developers. Serverless platforms enable devel... Request to download |
 | Top Threats to Cloud Computing: Pandemic 11 Deep Dive This publication reflects on eight recent cloud breach cases, presented as both a detailed narrative and a threat model. The threat model format provides ... Request to download |
 | Data Loss Prevention in Healthcare The rise of digital services in healthcare has made protecting medical data an ongoing challenge. Data loss may occur in several forms, including informat... Request to download |
.png) | FaaS Serverless Control Framework (Set) based on NIST 800-53 R5 controls This spreadsheet provides a cybersecurity control framework for Function-as-a-Service (FaaS) serverless deployments. The framework is based on the NIST 80... Request to download |