FICO

Offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services. It provides a set of Yes/No/NA questions and space to justify the response a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM).

Provides guidelines for CPAs to conduct SOC 2 engagements using criteria from the AICPA (Trust Service Principles, AT 101) and the CSA Cloud Controls Matrix.

Organizations who have the CSA Trusted Cloud Provider trustmark demonstrate a commitment to organizational security. They are a CSA Corporate Member, volunteer regularly for CSA, and have at least one staff member who has earned their CCSK.