Circle
Events
Blog

Research Topic

Open Certification Framework

Latest ResearchWorking Group
Open Certification Framework Working Group Charter
Open Certification Framework Working Group Charter

Download

Open Certification Framework
The Cloud Security Alliance has identified gaps within the IT ecosystem that are inhibiting market adoption of secure and reliable cloud services. Consumers do not have simple, cost effective ways to evaluate and compare their providers’ resilience, data protection and privacy capabilities and service portability. 

The CSA Open Certification Framework (OCF) is an industry initiative to allow global, trusted independent evaluation of cloud providers. It is a program for flexible, incremental and multi-layered cloud provider certification and/or attestation according to the Cloud Security Alliance’s industry leading security guidance and control framework. The program will integrate with popular third-party assessment and attestation statements developed within the public accounting community to avoid duplication of effort and cost.

As a critical step toward securing the digital foundation of our economy, we recommend that businesses reduce their reliance on proprietary, in-house security assessment programs related to cloud computing. Instead, we recommend leveraging the CSA’s Security, Trust & Assurance Registry (STAR) program and its associated assurance tools as core components of vetting and procuring cloud providers and services. We believe this emphasis on consistent, uniform cloud security standards will increase the security baseline for all participants in our economy. You can view the CSA STAR Registry here.

Help CSA move from “point-in-time” assurance to continuous assurance. This change requires moving away from manual audits and moving to the world of security metrics.While the idea of security metrics is not new, there is no standard reference in the industry that supports security metrics in a way that is comparable to what the CSA CCM or ISO/IEC 27002 does for security controls. To address this gap, CSA launched the Continuous Audit Metrics Working Group in early 2020 to build the first catalog of security metrics for the cloud. 

Open Certification FrameworkEnterprise ArchitectureCAIQCCAKSecurity Guidance

Discuss this topic in Circle

Have an interesting article or video on this topic that you want to share? Anyone can join the discussion community for this topic to share ideas or ask questions.

View discussion community

Participate in Open Certification Framework Research

The CSA Open Certification working group is an industry initiative to allow global, accredited, trusted certification of cloud providers.

View the working group

Open Certification Framework

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

The Evolution of STAR: Introducing Continuous Auditing

The Evolution of STAR: Introducing Continuous Auditing

For the most demanding cloud technology use cases, CSA created the STAR Level 3 program, further extending the scope of Level 2 to demonstrate continuous, automated, security, compliance, and privacy control effectiveness. CSA Continuous Auditing Certification (aka STAR Level 3) is the most rigorous assurance tier in the STAR program. Level 3-certified services providers can demonstrate that critical security controls are monitored and validated continuously, providing customers with the ultimate level of transparency and assurance.

Streamlining Vendor IT Security and Risk Assessments

Streamlining Vendor IT Security and Risk Assessments

Vendor security assessments generally consume a lot of time and cost while resulting in a limited understanding of a vendor’s risk profile. These inefficient assessments have trouble keeping up with the growing ecosystem of technology vendors—and especially the increased reliance on cloud security vendors. In such an ecosystem, technology leaders must redouble their efforts to improve vendor security oversight, risk assessment, and risk management activities. In this paper, the Cloud Security Alliance (CSA) and the National Technology Security Coalition (NTSC) are advocating for a new approach to how organizations manage risks, achieve assurance, and enable trust in the cloud.

Open Certification Framework Working Group Charter

Open Certification Framework Working Group Charter

The CSA Open Certification Framework (OCF) is an industry initiative to allow global, trusted independent evaluation of cloud providers. It is a program for flexible, incremental and multi-layered cloud provider certification and/or attestation according to the Cloud Security Alliance’s industry leading security guidance and control framework. 

Webinars

Using Intelligence with Splunk to Understand the Cloud Security Threat Landscape
Using Intelligence with Splunk to Understand the Cloud Secur...

September 13 | online

Learn more

Mitigating DDoS Attacks and Malware Spread
Mitigating DDoS Attacks and Malware Spread

September 7 | online

Learn more

Continuous Monitoring and the Future of Security Compliance
Continuous Monitoring and the Future of Security Compliance

August 17 | online

Learn more

The Building Blocks of a Cloud Native Security Program
The Building Blocks of a Cloud Native Security Program

July 28 | online

Learn more

Blog Posts

What an Auditor Should Know about Cloud Computing Part 3
​CSA STAR Attestation and STAR Certification Case Studies
Using CSA STAR to Improve Cloud Governance and Compliance