Join the
Zero Trust Working Group
This group is working to develop and raise awareness of best practices for implementing and operating secure Zero Trust architectures.
About This Working Group
This working group aims to develop Zero Trust standards to achieve consistency for cloud, hybrid and mobile endpoint environments. The topic of group discourse include Zero Trust benefits, architecture, automation and maturity models, publication reviews, and relevant industry forums and events.
During our meetings, we typically discuss changes in the industry and collaborate on projects the group is currently working on. This group will have the following nine workstreams:
- Zero Trust as a Philosophy & Guiding Principles
- Zero Trust Organizational Strategy & Governance
- Pillar: Identity
- Pillar: Device
- Pillar: Network/Environment
- Pillar: Applications & Workload
- Pillar: Data
- Automation, Orchestration, Visibility & Analytics
- Zero Trust Architecture, Implementation, and Maturity Model
Drafts & Important Docs
Latest Research developed by this Working Group
Explore the most recent publications and guidance developed by this working group.
.png)
How Participation Works
Explore how to get involved, from attending meetings to contributing to research and connecting with the community.
Attend Working Sessions
Stay ahead of emerging security trends, influence CSA initiatives, and collaborate directly with industry experts.
Shape Industry Research
Grow your professional reputation by contributing to globally recognized research and helping define industry best practices.
Expand Your Professional Network
Build meaningful connections with security leaders, practitioners, and peers from organizations around the world.
Zero Trust Working Group Sponsors
Organizations show their commitment to building awareness and understanding of zero trust principles when they become a Zero Trust Champion for CSA. Sponsor organizations demonstrate thought leadership in providing relevant security solutions for the next generation of IT-cloud computing.
Working Group Leadership
Meet the leaders guiding this Working Group's direction, research priorities, and community collaboration.
Daniele Catteddu
Chief Technology Officer, CSA
Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...
Erik Johnson
Cloud Security Specialist & Senior Research Analyst, CSA
Worked for the Federal Reserve for many years and volunteered with the CSA with a focus on CCM/CAIQ V4, specifically the STA domain, and developing a comprehensive framework and guidance for defining and managing the cloud shared security responsibility model (SSRM).
I recently retired from the Federal Reserve and am now consulting with the CSA as a Senior Research Analyst with a focus on Zero Trust and Financial Services.
Linke...
John Yeoh
Chief Scientific Officer, CSA
With over 15 years of experience in research and technology, John excels at executive-level leadership, relationship management, and strategy development. He is a published author, technologist, and researcher with areas of expertise in cybersecurity, cloud computing, information security, and next generation technology (IoT, Big Data, SecaaS, Quantum). John specializes in risk management, third party assessment, GRC, data protection, incid...
Working Group Co-Chairs
Alex Sharpe
Managing Director at Sharpe42
Biography: Mr. Sharpe is a long-time (+30 years) Cybersecurity, Governance, and Digital Transformation expert with real-world operational experience. Mr. Sharpe has run business units and has influenced national policy. He teaches Governance of AI and Resilience at the graduate level and is supporting the implementation of the resilience recommendations (PCAST report) made to the President. He has spent much of his career helping corporatio...
Shruti Kulkarni
Information Security Architect, Elexon
I am a security professional with experience across various domains of security. I work in defining organisation’s security strategy, security architecture and security practices. Translating business objectives and risk management strategies into specific security processes enabled by security technologies and services. I work on gap analysis, design, implementation and...
Josh Woodruff
Founder and CEO of MassiveScale.AI; Founding Chair, Agentic Trust Framework, CSAI
Josh Woodruff Founder & CEO, MassiveScale.AI; Founding Chair, Agentic Trust Framework, CSAI
Josh Woodruff runs MassiveScale.AI, where he shapes a company's full AI plan from the agents worth building to the security and governance foundation that protects them. He wrote the Agentic Trust Framework, the first Zero Trust governance specification built for AI agents, and chairs the framework at CSAI, the Cloud Security Allian...
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC
Michael Roza is a seasoned risk, audit, control and compliance, and cybersecurity professional with over 20 years of experience across multinational enterprises and startups. As a Cloud Security Alliance (CSA) Research member for over 10 years, he has led and contributed to more than 140 CSA projects spanning Zero Trust, AI, IoT, Top Threats, DecSecOps, Cloud Key Management, Cloud Control Matrix, and many others.
He has co-chaired...
Krishna Narayanaswamy
Founder & CTO at Netskope
A highly regarded and awarded researcher in security, behavioral anomaly detection, and deep packet inspection, Krishna brings two decades of technical and thought leadership as founder and chief technology officer at Netskope. Krishna leads Netskope’s data science and user behavior research and is a prolific writer and speaker on a range of cloud security topics. He has authored more than 100 patents and co-authored the industry&rsqu...
Chandra Rajagopalan
Principal Engineer, Netskope
Chandra Rajagopalan is a seasoned professional in cloud security and software, with over 20 years of industry experience. With more than ten approved patents in cybersecurity and computing, Chandra's technical acumen and deep insights are evident. His contributions to the Cloud Security Alliance (CSA), particularly in Zero Trust, highlight his dedication to advancing cybersecurity standards. Notably, he played a pivotal role in developing t...
Jerry Chapman
CTO and Co-founder, Numberline Security
With over 25 years of industry experience, Jerry has successfully guided numerous clients in the design and implementation of their enterprise IAM strategies, in ways that align with both security and business objectives. His job roles have spanned enterprise architecture, solution engineering, and software architecture and development. Jerry is a co-author of “Zero Trust Security: An Enterprise Guide”.
Jason Garbis
Founder and Principal at Numberline Security
Jason Garbis is Founder and Principal at Numberline Security, a consulting firm helping enterprises prepare for, define, and execute on effective Zero Trust security strategies. Jason has authored several books, including Zero Trust Security: An Enterprise Guide, is co-chair of the Zero Trust Working Group at the Cloud Security Alliance, and is a frequent speaker at industry conferences. Jason holds a CISSP certification, has a BS in Comput...
Chris Steffen
VP of Research at Enterprise Management Associates
Chris is the director of information security/risk and compliance management for a technology industry analyst and consulting firm. He is an industry thought leader and has presented at numerous industry conferences and has been interviewed by multiple media sources. He holds over a dozen technical certifications, including CISSP and CISA.