It’s time to move from “point-in-time” assurance to continuous assurance, whereby the effectiveness of an organization’s security controls is evaluated on a monthly, weekly, or hourly basis. This change requires moving away from manual audits and spreadsheets and instead focusing on building automated tools that continuously assess the effectiveness of an information system. In other words, it’s time to move to the world of security metrics.
While the idea of security metrics is not new, there is no standard reference in the industry that supports security metrics in a way that is comparable to what the CSA CCM or ISO/IEC 27002 does for security controls. To address this gap, CSA launched the Continuous Audit Metrics Working Group in early 2020 to build the first catalog of security metrics for the cloud.
We have released the first version of this catalog as a request for comment. It contains an initial set of 33 security metrics, each mapped to the CSA CCMv4. We invite the community to provide feedback by directly providing comments in the document or sending them to [email protected] Please share this work as widely as possible.
The Continuous Audit Metrics working group aims to define a catalogue of security attributes and their corresponding metrics, derived from the CSA Cloud Controls Matrix (CCM), which can be used as a reference for auditors, cloud service providers, cloud customers and security solution vendors that wish to engage in continuous audit-based self-assessments or certifications.