SaaS services present unique risks to their cloud customers since they:
- Are highly business process specific;
- Handle and store critical business and personal data.
- Integrate a broad array of service components, operating over a deep application stack.
- May depend on multiple cloud service providers.
This group has already started writing the SaaS Governance Best Practice for SaaS Customers . You can preview the chapters in progress below:Interested in what you can do to improve SaaS governance?
The Security, Trust, Assurance, and Risk (STAR) Registry allows cloud customers to view the controls implemented by popular SaaS providers. Based on the controls outlined in the Cloud Controls Matrix, providers submit the CAIQ to this publicly available registry. This allows cloud customers to easily access and assess offerings from popular cloud providers. View CSA’s registry of secure companies
This group aims to benefit all parties in the Software-as-a-Service (SaaS) ecosystem by supporting a common understanding of SaaS related risks from the perspectives of the cloud customer and cloud service provider.
Cloud Security Research
CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.
Cloud Octagon Model
While not created by this working group, the Cloud Octagon Model helps provide context and background to SaaS Governance. The model is an approach to assess risk in SaaS cloud computing. It provides practical guidance and structure to all involved risk parties in order to keep pace with rapid changes in privacy and data protection laws and regulations, and changes in technology.
The 2020 State of Identity Security in the Cloud
The use of cloud services have continued to increase over the past decade. Particularly in the wake of the COVID-19 public health crisis, many enterprises' digital transformations are on an accelerated track to enable employees to work from home. CSA surveyed these organizations to better understand how cloud services are being used during this transition and how organizations are securing their operations over the next 12 months.
SaaS Governance Best Practice for Cloud Customers (in progress)
The SaaS Governance Best Practice for SaaS Customers is a baseline set of fundamental SaaS governance practices for SaaS Customers. It enumerates and considers risks during all stages of the SaaS adoption lifecycle and takes into account the SaaS usage lifecycle. It will also aim to provide mitigation measures from the cloud customer’s perspective.
Security, Trust, Assurance and Risk (STAR) Registry
The STAR allows CSPs to submit the CAIQ questionnaire in order to validate their security offerings.
View CSA’s registry of secure cloud providers
