ChaptersEventsBlog
Share how your organization is preparing for the agentic shift in identity governance. Take the Securing AI Agents Survey by October 10 →

Working Group

Security Controls Catalog

Expanding CSA's CCM, developing implementation guidelines, and maintaining a repository of controls as code.
Security Controls Catalog
This working group focuses on expanding and standardizing cybersecurity control objectives across various technologies, including Cloud, AI, and IoT/OT. It extends the CSA Cloud Control Matrix (CCM), ensuring interoperability with global frameworks. The group also defines control implementation guidelines, maintains a repository of technical controls as code, and enables automation to streamline compliance integration and enforcement.

  • Expands CSA’s Cloud Control Matrix (CCM) to support diverse technologies (Cloud, AI, IoT/OT).
  • Standardizes controls for interoperability across regulatory frameworks.
  • Develops vendor-agnostic and vendor-specific implementation guidelines for control adoption.
  • Defines control objectives related to cybersecurity, privacy, safety, and accountability.
  • Establishes a repository of technical controls as code to streamline compliance integration.

Working Group Leadership

Andy Ruth
Andy Ruth

Andy Ruth

Content Developer, CSA

Daniele Catteddu
Daniele Catteddu

Daniele Catteddu

Chief Technology Officer, CSA

Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...

Read more

Larry Hughes
Larry Hughes

Larry Hughes

VP of Research & Development, CSA

Larry Hughes is the Vice President of Research and Development at the Cloud Security Alliance. With more than 20 years of experience in the security industry, Larry’s holds five advanced security certifications, including CCSK, CCSP, and CISSP. His past roles include Principal Consultant at LJH Cybersecurity, GRC Director at Equinix, and Head of Information Security at 

Read more

Publications in ReviewOpen Until
Applying Zero Trust Principles with Network-Infrastructure Hiding Protocol - Stealth Mode Software Defined Perimeter for Network InfrastructureOct 16, 2025
Enabling Zero Trust for Cellular Networks - Guidance for Securing Mobile NetworksOct 16, 2025
View all
Who can join?

Anyone can join a working group, whether you have years of experience or want to just participate as a fly on the wall.

What is the time commitment?

The time commitment for this group varies depending on the project. You can spend a 15 minutes helping review a publication that's nearly finished or help author a publication from start to finish.

Virtual Meetings

Attend our next meeting. You can just listen in to decide if this group is a good for you or you can choose to actively participate. During these calls we discuss current projects, and well as share ideas for new projects. This is a good way to meet the other members of the group. You can view all research meetings here.

Open Peer Reviews

Peer reviews allow security professionals from around the world to provide feedback on CSA research before it is published.

Learn how to participate in a peer review here.

Applying Zero Trust Principles with Network-Infrastructure Hiding Protocol - Stealth Mode Software Defined Perimeter for Network Infrastructure

Open Until: 10/16/2025

Our core TCP/IP networking systems and protocols have been with us since the 1970s, and have in many ways served us well. T...

Enabling Zero Trust for Cellular Networks - Guidance for Securing Mobile Networks

Open Until: 10/16/2025

The rapid evolution of cellular network technologies, particularly the rollout of 5G, Open Radio Access Network (ORAN), and...