Open Certification Framework Arrow to Content

OCF Working Group

Introduction to the Open Certification Framework

The CSA Open Certification Framework is an industry initiative to allow global, accredited, trusted certification of cloud providers.

The CSA Open Certification Framework is a program for flexible, incremental and multi-layered cloud provider certification according to the Cloud Security Alliance’s industry leading security guidance and control objectives.

The program will integrate with popular third-party assessment and attestation statements developed within the public accounting community to avoid duplication of effort and cost.

The CSA Open Certification Framework is based upon the control objectives and continuous monitoring structure as defined within the CSA GRC (Governance, Risk and Compliance) Stack research projects.

The CSA Open Certification Framework will support several tiers, recognizing the varying assurance requirements and maturity levels of providers and consumers. These will range from the CSA Security, Trust and Assurance Registry (STAR) self-assessment to high-assurance specifications that are continuously monitored.

The CSA Open Certification Framework provides:

  • A path for any region to address compliance concerns with trusted, global best practices. For example, we expect governments to be heavy adopters of the CSA Open Certification Framework to layer their own unique requirements on top of the GRC Stack and provide agile certification of public sector cloud usage.
  • An explicit guidance for providers on how to use GRC Stack tools for multiple certification efforts. For example, scoping documentation will articulate the means by which a provider may follow an ISO/IEC 27001 certification path that incorporates the CSA Cloud Controls Matrix (CCM).
  • A "recognition scheme" that would allow us to support ISO, AICPA and potentially others that incorporate CSA IP inside of their certifications/framework. CSA supports certify-once, use-often, where possible.

CSA aims to harmonize and simplify provider certifications, not complicate them.

Open Certification Framework Leadership

Daniele Catteddu CSA Managing Director EMEA

Star Certification Co-Chairs:
John Di Maria
Andreas Fuchsberger

STAR Attestation chair
Audrey Katcher

Key Links & Resources

Publicizing Your STAR Certification

Publicizing Your STAR Certification

The following guidelines will help you to apply good practice in publicizing, communicating and promoting your certification to stakeholders, including staff, customers and business partners, and to the general public.

Release Date: September 03, 2013

Requirements for Bodies Providing STAR Certification

Requirements for Bodies Providing STAR Certification

This document outlines how to conduct a STAR certification assessments to the Cloud Controls Matrix (CCM) as part of an ISO 27001 assessment.

Release Date: September 03, 2013

STAR Certification Guidance Document: Auditing the Cloud Controls Matrix (CCM)

STAR Certification Guidance Document: Auditing the Cloud Controls Matrix (CCM)

There are a number of control areas on the CCM that will each be awarded a management capability score on a scale of 1-15. To decide what the score is each control area will be considered against 5 capability factors.

Release Date: September 03, 2013

OCF Vision Statement

OCF Vision Statement

The CSA Open Certification Framework is a program for flexible, incremental and multi-layered cloud provider certification according to the Cloud Security Alliance’s industry leading security guidance and control objectives.

Release Date: August 17, 2012

Open Certification Framework News

May 15, 2013

Cloud Security Alliance Successfully Completes Open Certification Framework (OCF) Pilot Implementations with Alibaba and New Taipei City Government

Representatives to discuss cloud computing pilot results and key learnings at CSA Congress APAC.

February 08, 2013

Cloud Security Alliance and Electronic Government Agency (EGA) of Thailand Partner to Drive Cloud Computing Adoption in the Association of Southeast Asian Nations

CSA today announced that it has signed a formal partnership with the Electronic Government Agency (EGA) of Thailand.

August 20, 2012

CSA Announces Open Security Framework for Cloud Providers

The Cloud Security Alliance (CSA) today announces additional details of its Open Certification Framework, and its partnership with BSI (British Standards Institution).

May 09, 2012

SecureCloud 2012 in Frankfurt: Global Leaders Address Top Emerging Issues on Cloud Security and Privacy

How will changes in European data protection regulation affect cloud providers and users? How will forensics look like in the Cloud?

May 09, 2012

CSA Announces Open Certification Framework for Cloud Providers

At the opening of the SecureCloud 2012 conference, CSA announced the CSA Open Certification Framework, an industry initiative to allow global, trusted certification of cloud providers.

Page Dividing Line