Open Certification Framework

Latest ResearchJoin Group
The Evolution of STAR: Introducing Continuous Auditing
The Evolution of STAR: Introducing Continuous Auditing

Download

Join this working group
Open Certification Framework
The Cloud Security Alliance has identified gaps within the IT ecosystem that are inhibiting market adoption of secure and reliable cloud services. Consumers do not have simple, cost effective ways to evaluate and compare their providers’ resilience, data protection and privacy capabilities and service portability. 

The CSA Open Certification Framework (OCF) is an industry initiative to allow global, trusted independent evaluation of cloud providers. It is a program for flexible, incremental and multi-layered cloud provider certification and/or attestation according to the Cloud Security Alliance’s industry leading security guidance and control framework. The program will integrate with popular third-party assessment and attestation statements developed within the public accounting community to avoid duplication of effort and cost.

As a critical step toward securing the digital foundation of our economy, we recommend that businesses reduce their reliance on proprietary, in-house security assessment programs related to cloud computing. Instead, we recommend leveraging the CSA’s Security, Trust & Assurance Registry (STAR) program and its associated assurance tools as core components of vetting and procuring cloud providers and services. We believe this emphasis on consistent, uniform cloud security standards will increase the security baseline for all participants in our economy.

You can view the CSA STAR Registry here.→

Help CSA move from “point-in-time” assurance to continuous assurance.
This change requires moving away from manual audits and moving to the world of security metrics.While the idea of security metrics is not new, there is no standard reference in the industry that supports security metrics in a way that is comparable to what the CSA CCM or ISO/IEC 27002 does for security controls. To address this gap, CSA launched the Continuous Audit Metrics Working Group in early 2020 to build the first catalog of security metrics for the cloud.

Open Certification FrameworkEnterprise ArchitectureCAIQCCAKSecurity Guidance

The CSA Open Certification working group is an industry initiative to allow global, accredited, trusted certification of cloud providers.

Next Meeting

No Meetings Currently Scheduled



Working Group Leadership

Andrew Williams Headshot
Andrew Williams
Andrew Williams

Director of Program Development, Coalfire

Andrew Williams is the Director of Program Development at Coalfire. In this role, he is responsible for working closely with Coalfire customers, industry bodies and regulatory authorities, and internal stakeholders to ensure Coalfire’s services, delivery, and talent are aligned to the needs of the future compliance and security landscape.

Andrew previously worked as practice director for Coalfire’s cloud assessment and risk advisory...

Read more

Ryan Mackie Headshot
Ryan Mackie
Ryan Mackie

Principal, Schellman & Company

Ryan Mackie is a Principal at Schellman & Company, LLC. Ryan manages SOC, PCI-DSS, ISO, HIPAA, and Cloud Security Alliance (CSA) STAR Certification and Attestation service delivery and also oversees the firm-wide methodology and execution for the ISO certification services, including ISO 27001, ISO 9001, ISO 20000, and ISO 22301 as well as CSA STAR certification services. He has over 20 years of experience, including 14 at Schellman, 2 at P...

Read more

Ronald Tse Headshot
Ronald Tse
Ronald Tse

CEO, Ribose

Ronald has served CSA in numerous capacities, including as a member of CSA's APAC Research Advisory and International Standardization Council. Additionally, he co-chairs the Open Certification Framework (OCF), SaaS Governance, and DevSecOps working groups. He is the founder and CEO of Ribose, where under his leadership the company has been consistently awarded the industry's highest cloud security ratings, including being the on...

Read more

Andreas Fuchsberger Headshot
Andreas Fuchsberger
Andreas Fuchsberger

Regional Standards Officer, Microsoft’s Corporate Standards Group

Andreas Fuchsberger is a Standards Officer in Microsoft’s Corporate Standards Group. In this role he participates in the international standards community, predominantly attending ISO/IEC JTC 1/SC 27 (IT Security Techniques) as a UK NB delegateITU-T SG 17 (Security) as an ISO invited expert. Currently for SC 27 he is the convener of the Special Working Group on Traversal Items and the editor of 2 international standards on network security ...

Read more

John DiMaria Headshot
John DiMaria
John DiMaria

Assurance Investigatory Fellow, CSA

This person does not have a biography listed with CSA.

Daniele Catteddu Headshot
Daniele Catteddu
Daniele Catteddu

Chief Technology Officer, CSA

Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...

Read more

Join this working group

Open Certification Framework

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

STAR Continuous Technical Guidance

STAR Continuous Technical Guidance

 STAR Continuous specifies the necessary activities and conditions for the continuous auditing of the cloud service over a defined set of security requirements, covering aspects from governance to infrastructure, and requiring the cloud service to define necessary processes that will be executed during the validation of controls within the scope of assessment. The program promotes trust by ensuring that a cloud service’s necessary activities and conditions are continuously met by through continuous auditing, such as through the operationalization of security and privacy requirements. This document explains the program and how to achieve STAR Continuous for an organization. 

The Evolution of STAR: Introducing Continuous Auditing

The Evolution of STAR: Introducing Continuous Auditing

For the most demanding cloud technology use cases, CSA created the STAR Level 3 program, further extending the scope of Level 2 to demonstrate continuous, automated, security, compliance, and privacy control effectiveness. CSA Continuous Auditing Certification (aka STAR Level 3) is the most rigorous assurance tier in the STAR program. Level 3-certified services providers can demonstrate that critical security controls are monitored and validated continuously, providing customers with the ultimate level of transparency and assurance..

Streamlining Vendor IT Security and Risk Assessments

Streamlining Vendor IT Security and Risk Assessments

 Vendor security assessments generally consume a lot of time and cost while resulting in a limited understanding of a vendor’s risk profile. These inefficient assessments have trouble keeping up with the growing ecosystem of technology vendors—and especially the increased reliance on cloud security vendors. In such an ecosystem, technology leaders must redouble their efforts to improve vendor security oversight, risk assessment, and risk management activities. In this paper, the Cloud Security Alliance (CSA) and the National Technology Security Coalition (NTSC) are advocating for a new approach to how organizations manage risks, achieve assurance, and enable trust in the cloud. 

Blog Posts

What an Auditor Should Know about Cloud Computing Part 3
​CSA STAR Attestation and STAR Certification Case Studies
Using CSA STAR to Improve Cloud Governance and Compliance