CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | Map the Transaction Flows for Zero Trust The NSTAC Report to the President on Zero Trust defines five steps to implementing a Zero Trust security strategy. This publication provides guidance on e... Request to download |
 | Top Concerns With Vulnerability Data The top vulnerability management frameworks used today include the Common Vulnerabilities and Exposures (CVE) program and the Common Vulnerability Scoring... Request to download |
 | Using Asymmetric Cryptography to Help Achieve Zero Trust Objectives This publication explores the use of asymmetric cryptography in Zero Trust. Asymmetric cryptography provides an industry-standard, secure method to establ... Request to download |
 | The State of Multi-Cloud Identity Survey Enterprises encounter significant obstacles when adopting multi-cloud. Namely, harmonizing hybrid and cloud identity systems for secure integration. Ident... Request to download |
 | Zero Trust Guidance for Critical Infrastructure In most nations, the health of public services relies on secure and resilient Critical Infrastructure. We call these infrastructures "critical" because th... Request to download |
 | The State of Non-Human Identity Security Non-human identities (NHIs) include bots, API keys, service accounts, OAuth tokens, and secrets. These identities keep today’s organizations running smoot... Request to download |
 | Confidential Computing Working Group Charter 2024 The working group is tasked with exploring and implementing Confidential Computing technologies to enhance data security across various industries. This g... Request to download |
 | Zero Trust Guiding Principles v1.1 Zero Trust is a strategic mindset that is highly useful for organizations to adopt as part of their digital transformations. Based on the idea of "never t... Request to download |
 | Strengthening Research Integrity with High-Performance Computing (HPC) Security High-Performance Computing (HPC) systems aggregate computing resources to gain performance greater than that of a single workstation. HPC systems have bec... Request to download |
 | Top Threats to Cloud Computing 2024 The CSA Top Threats Report aims to raise awareness of current cloud security risks, threats, and vulnerabilities. In this 2024 installment, we surveyed ov... Request to download |
 | Quantum-Safe Security Governance with the Cloud Controls Matrix For the last decade or so there have been major developments in the quantum and post-quantum cryptography spaces. The time has come for enterprise IT depa... Request to download |
%20Controls%20Framework%20Thumbnail.png) | Enterprise Authority To Operate (EATO) Controls Framework Many small and mid-sized cloud-based Anything-as-a-Service (XaaS) vendors struggle to implement robust information security controls. These security gaps ... Request to download |
 | SaaS Governance Best Practices for Cloud Customers - Korean Translation This localized version of this publication was produced from the original source material through the efforts of chapters and volunteers but the translate... Request to download |
 | CCM v4.0 Implementation Guidelines This document will help you understand how to navigate through the Cloud Controls Matrix v4 to use it effectively and interpret and implement the CCM cont... Request to download |
 | Cloud Controls Matrix and CAIQ v4 The Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing aligned to the CSA best practices, that is considered the de-facto s... Request to download |
 | Identity and Access Management Working Group Charter 2024 Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using Identity Access Management (IAM)... Request to download |
 | Information Technology Governance, Risk, and Compliance in Healthcare v2 Healthcare organizations are increasingly using cloud services. However, the transition to the cloud presents many Governance, Risk, and Compliance (GRC) ... Request to download |
 | The Six Pillars of DevSecOps: Measure, Monitor, Report, and Action The implementation and maintenance of DevSecOps initiatives can take anywhere from a few months to several years to implement. Therefore, continuous measu... Request to download |
 | HSM-as-a-Service Use Cases, Considerations, and Best Practices A Hardware Security Module (HSM) is a certified, trusted platform for performing cryptographic operations and protecting keys. It is a tamper-responsive a... Request to download |
 | Defining the Zero Trust Protect Surface Enterprise adoption and implementation of Zero Trust is broad and growing. Venture Beat reports that 90% of organizations moving to the cloud are adopting... Request to download |