CSA Research Publications
Whitepapers, Reports and Other Resources
Browse Publications
 | Agentic AI Identity and Access Management: A New Approach Release Date: 08/18/2025 Agentic AI is pushing the boundaries of automation, autonomy, and decision-making at machine speed. But traditional identity and access management (IAM) p... Request to download |
 | Secure Agentic System Design: A Trait-Based Approach Release Date: 07/30/2025 Thanks to powerful reasoning models, AI agents are making more nuanced decisions and interacting more effectively with their environments. At the same tim... Request to download |
 | Release Date: 07/28/2025 The CCM Working Group is responsible for maintaining and evolving the Cloud Security Alliance’s foundational framework for cloud security assurance, the C... Request to download |
 | Cyber Resiliency in Financial Services Survey Report Release Date: 07/16/2025 Data resiliency and operational security have become increasingly critical as digital transformation accelerates. The financial industry faces distinct ch... Request to download |
 | Healthcare Confidential Computing and the Trusted Execution Environment Release Date: 07/14/2025 Healthcare Delivery Organizations (HDOs) routinely process Protected Health Information (PHI), Personally Identifiable Information (PII), and financial da... Request to download |
 | Fully Homomorphic Encryption to CCM v4.0.1 Mapping Release Date: 06/09/2025 We are seeking input from industry and legal professionals with experience in cloud security and policy, and comment from Fully Homomorphic Encryption spe... Request to download |
 | CAVEaT Working Group Charter 2025 Release Date: 06/26/2025 The Cloud Security Alliance (CSA), in collaboration with the MITRE Corporation, established the Cloud Adversarial Vectors, Exploits, and Threats (CAVEaT™)... Request to download |
 | Navigating the Human Factor: Addressing Employee Resistance to AI Adoption Release Date: 06/25/2025 In boardrooms around the world, leaders are hailing artificial intelligence (AI) as a game-changer for efficiency and innovation. Many organizations have ... Request to download |
 | Zero Trust Automation & Orchestration and Visibility & Analytics Overview Release Date: 06/04/2025 Visibility & Analytics and Automation & Orchestration are foundational, cross-cutting capabilities within the Zero Trust paradigm. They enable con... Request to download |
 | Dynamic Process Landscape: A Strategic Guide to Successful AI Implementation Release Date: 06/02/2025 Artificial Intelligence (AI) adoption in business and manufacturing is failing at least twice as often as it succeeds. Companies are trying to integrate A... Request to download |
 | Release Date: 05/28/2025 Agentic AI systems represent a significant leap forward for AI. Their ability to plan, reason, act, and adapt autonomously introduces new capabilities and... Request to download |
 | Release Date: 05/27/2025 Traditional security models treat Internet of Things (IoT) security solely as a long-term supply chain concern. This is a significant oversight in today's... Request to download |
 | Top Threats to Cloud Computing - Deep Dive 2025 Release Date: 04/28/2025 This report uses the threats identified in CSA’s Top Threats to Cloud Computing 2024 to reflect on eight recent cybersecurity breaches. Notable incidents ... Request to download |
 | State of SaaS Security Report 2025 Release Date: 04/21/2025 Software-as-a-Service (SaaS) applications have become foundational to modern business operations. However, organizations are also facing a rising tide of ... Request to download |
 | Requirements for Bodies Providing STAR Certification Release Date: 03/31/2025 This document outlines how to conduct STAR certification assessments to the Cloud Controls Matrix (CCM) as part of an ISO 27001 assessment. The STAR certi... Request to download |
.png) | CSA Code of Conduct to EU Cloud Code of Conduct Mapping Release Date: 03/24/2025 Navigating General Data Protection Regulation (GDPR) compliance requirements can be challenging. Fortunately, Codes of Conduct (CoCs) provide a straightfo... Request to download |
 | Cloud Key Management Working Group Charter 2025 Release Date: 03/18/2025 Cloud services are becoming ubiquitous in all sizes, and customers encounter many obligations and opportunities for using key management systems with thos... Request to download |
 | Release Date: 03/11/2025 Shadow Access is undesired or unauthorized access to resources, such as applications, networks, and data. Shadow Access is increasingly a cloud issue, res... Request to download |
| The State of Data Privacy Engineering Release Date: 03/10/2025 This paper provides a comprehensive overview of Data Privacy Engineering (DPE), its importance, and its application in today's data-driven world. It will ... Request to download |
 | The Six Pillars of DevSecOps Bundle Release Date: 03/10/2025 DevOps enhances the management of information security, but its execution must be secured to avoid vulnerabilities like lax firewall rules or default cred... Request to download |