Cloud 101CircleEventsBlog
Join us for Cybersecurity Awareness Month! Strengthen your cyber resilience with essential security tips and resources for everyone.

Research Topic

Continuous Assurance Metrics

The Continuous Audit Metrics Catalog
The Continuous Audit Metrics Catalog

Download

Continuous Assurance Metrics
Are traditional infosec assurance tools outdated? Many cloud customers think so. They see that technology changes quickly, and products are frequently evolving with continuous integration and deployment. Therefore, a certification obtained once a year after a third-party audit is not a sufficient source of assurance anymore.
 
It’s time to move from “point-in-time” assurance to continuous assurance, whereby the effectiveness of an organization’s security controls is evaluated on a monthly, weekly, or hourly basis. This change requires moving away from manual audits and spreadsheets and instead focusing on building automated tools that continuously assess the effectiveness of an information system. In other words, it’s time to move to the world of security metrics.
 
While the idea of security metrics is not new, there is no standard reference in the industry that supports security metrics in a way that is comparable to what the CSA CCM or ISO/IEC 27002 does for security controls. To address this gap, CSA launched the Continuous Audit Metrics (now Continuous Assurance Metrics) Working Group in early 2020 to build the first catalog of security metrics for the cloud.
 
We have released the first version of this catalog as a request for comment. It contains an initial set of 33 security metrics, each mapped to the CSA CCMv4. We invite the community to provide feedback by directly providing comments in the document or sending them to [email protected]. Please share this work as widely as possible.


Continuous Assurance MetricsConsensus AssessmentsCloud Controls MatrixOpen Certification Framework

Discuss this topic in Circle

View discussion community

Continuous Assurance

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

The Continuous Audit Metrics Catalog

The Continuous Audit Metrics Catalog

Are traditional infosec assurance tools outdated? Many cloud customers think so. They see that technology changes quickly, and products are frequently evolving with continuous integration and deployment. Therefore, a certification obtained once a year after a third-party audit is not asufficient source of assurance anymore. It’s time to move from “point-in-time” assurance to continuous assurance. This change requires moving away from manual audits and instead building automated tools that continuously assess the effectiveness of an information system. In other words, it’s time to move to the world of security metrics.

Webinars

Impact of Digital Transformation on Security Strategy
Impact of Digital Transformation on Security Strategy

October 28 | Online

Learn more

Security-as-Code:  What's Real and What's Possible with Self-Service and Developer Speed Governance
Security-as-Code: What's Real and What's Possible with Self...

October 26 | TBD

Learn more

Standardize Identity Security: From On-Prem to Multi-Cloud
Standardize Identity Security: From On-Prem to Multi-Cloud

November 16 | Online

Learn more

Transforming Enterprise Cloud Security to Supercharge Developer Velocity
Transforming Enterprise Cloud Security to Supercharge Develo...

November 19 | Online

Learn more

Blog Posts

Continuous Compliance Monitoring: A Must-Have Strategy
Overcoming Challenges in Governing Scanner Adoption - Step by Step
The DORA Quest: Beware of Vendors with Magic Beans