Cloud 101CircleEventsBlog
Master CSA’s Security, Trust, Assurance, and Risk program—download the STAR Prep Kit for essential tools to enhance your assurance!

Research Topic

SaaS Governance

SaaS Governance Best Practices for Cloud Customers
SaaS Governance Best Practices for Cloud Customers

Download

SaaS Governance
Security and privacy are the primary concerns for organizations considering SaaS adoption, and recent research indicates that 77% of SaaS-adopting organizations have experienced SaaS-specific security incidents. SaaS services account for the bulk of the cloud industry market, and any security incident could critically impact cloud customers. 

SaaS services present unique risks to their cloud customers since they:
  • Are highly business process specific;
  • Handle and store critical business and personal data.
  • Integrate a broad array of service components, operating over a deep application stack.
  • May depend on multiple cloud service providers. 

Due to heavy competitive pressure in the SaaS market today, security is too often not a top priority for SaaS providers – especially for the smaller providers that may not have the necessary security expertise to identify and manage the risks that could impact cloud customers and the cloud provider’s own operations. The SaaS Governance Working Group encourages and defines mechanisms to ensure the security of customer data and the resilience of the SaaS cloud infrastructure. 

This group has already started writing the SaaS Governance Best Practice for SaaS Customers . You can preview the chapters in progress below:

Interested in what you can do to improve SaaS governance?
The Security, Trust, Assurance, and Risk (STAR) Registry allows cloud customers to view the controls implemented by popular SaaS providers. Based on the controls outlined in the Cloud Controls Matrix, providers submit the CAIQ to this publicly available registry. This allows cloud customers to easily access and assess offerings from popular cloud providers.View CSA’s registry of secure companies here. 

SaaS Governance

Cloud Security Research

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

Cloud Octagon Model

Cloud Octagon Model

While not created by this working group, the Cloud Octagon Model helps provide context and background to SaaS Governance. The model is an approach to assess risk in SaaS cloud computing. It provides practical guidance and structure to all involved risk parties in order to keep pace with rapid changes in privacy and data protection laws and regulations, and changes in technology. 

The 2020 State of Identity Security in the Cloud

The 2020 State of Identity Security in the Cloud

The use of cloud services has continued to increase over the past decade. Particularly in the wake of the COVID-19 public health crisis, many enterprises' digital transformations are on an accelerated track to enable employees to work from home. CSA surveyed these organizations to better understand how cloud services are being used during this transition and how organizations are securing their operations over the next 12 months.

SaaS Governance Best Practice for Cloud Customers (Coming Soon!)

The SaaS Governance Best Practice for SaaS Customers is a baseline set of fundamental SaaS governance practices for SaaS Customers. It enumerates and considers risks during all stages of the SaaS adoption lifecycle and takes into account the SaaS usage lifecycle. It will also aim to provide mitigation measures from the cloud customer’s perspective.

Webinars

Impact of Digital Transformation on Security Strategy
Impact of Digital Transformation on Security Strategy

October 28 | Online

Learn more

Standardize Identity Security: From On-Prem to Multi-Cloud
Standardize Identity Security: From On-Prem to Multi-Cloud

November 16 | Online

Learn more

Transforming Enterprise Cloud Security to Supercharge Developer Velocity
Transforming Enterprise Cloud Security to Supercharge Develo...

November 19 | Online

Learn more

Why Using Common Controls Changed The Game for Nutanix & Qorus
Why Using Common Controls Changed The Game for Nutanix & Qorus

December 10 | Online

Learn more

Blog Posts

Mitigating GenAI Risks in SaaS Applications
How to Simulate Session Hijacking in Your SaaS Applications
How to Prepare for Inevitable Risks to Your SaaS Data