Working Group
Security Controls Catalog
Expanding CSA's CCM, developing implementation guidelines, and maintaining a repository of controls as code.
- Define and maintain a canonical set of cloud- and technology-agnostic controls and control metadata aligned with industry standards, regulations, and CSA-specific frameworks (CCM, AICM, IoT, etc.)
- Ensure interoperability and mapping across global regulatory frameworks, industry standards, and risk management approaches through a common controls schema and ontology
- Support the development, curation, and publication of machine-consumable control representations (e.g., JSON, YAML, and OSCAL API-accessible formats) for integration into third-party tools and platforms
- Provide governance for the lifecycle management of control content, including version control, audit trail, change management, and deprecation
- Develop implementation and auditing guidance that supports adoption and tailoring of controls across different cloud service models, sectors, and compliance use cases
- Collaborate with other CSA working groups, including CCM, STAR, AI safety and assurance, and regulatory mapping to ensure cross-domain alignment and reduce redundancy across controls
- Serve as an expert advisory and review body for control framework updates, proposed mappings, and external contributions
- Drive ongoing analysis and integration of global regulatory and policy changes into the catalog to ensure relevance and applicability
- Promote awareness, adoption, and contributions to the Security Controls Catalog through public engagement, webinars, community calls, and working sessions
- Establish sub-groups or focused task forces to address specialized topics such as controls rationalization, sector-specific requirements, real-time monitoring and reporting, automation, and machine-readability
Working Group Leadership
Andy Ruth
Content Developer, CSA
Daniele Catteddu
Chief Technology Officer, CSA
Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...
Larry Hughes
VP of Research & Development, CSA
Larry Hughes is the Vice President of Research and Development at the Cloud Security Alliance. With more than 20 years of experience in the security industry, Larry’s holds five advanced security certifications, including CCSK, CCSP, and CISSP. His past roles include Principal Consultant at LJH Cybersecurity, GRC Director at Equinix, and Head of Information Security at
| Publications in Review | Open Until |
|---|---|
| Post-Quantum Cryptography Key Management | Mar 27, 2026 |
| Leveraging the Health Data from IoT Wearables | Mar 31, 2026 |
| Comparing FHE and Other PETs | Apr 17, 2026 |
| MLOps Threat Model | Apr 17, 2026 |
Who can join?
Anyone can join a working group, whether you have years of experience or want to just participate as a fly on the wall.
What is the time commitment?
The time commitment for this group varies depending on the project. You can spend a 15 minutes helping review a publication that's nearly finished or help author a publication from start to finish.
Virtual Meetings
Attend our next meeting. You can just listen in to decide if this group is a good for you or you can choose to actively participate. During these calls we discuss current projects, and well as share ideas for new projects. This is a good way to meet the other members of the group. You can view all research meetings here.
Open Peer Reviews
Peer reviews allow security professionals from around the world to provide feedback on CSA research before it is published.