Cloud Security Alliance releases Cloud Controls Matrix 3.0

The Cloud Security Alliance (CSA) released the CSA Cloud Control Matrix (CCM) 3.0, the standard for assessing cloud centric information security risks.

It expands its control domains to address changes in cloud security risks since the release of the CSA’s seminal guidance domain, “Security Guidance for Critical Areas of Focus in Cloud Computing version 3.0″ while making strides towards closer harmonization of the two.

Having drawn from industry-accepted security standards, regulations, and control frameworks such as ISO 27001/2, the ENISA Information Assurance Framework, ISACA’s Control Objectives for Information and Related Technology, the American Institute of CPAs Trust Service and Principals PCI DSS, and the Federal Risk and Authorization Management Program, the updated CSA CCM control domain provides organizations with the cohesiveness of controls needed to manage cloud centric information security risks.

This major restructuring of the CCM also captures the needs of cloud security governance in the near future, where it will serve as an annual check in updating future controls, further ensuring CCM remains in line with future technology and policy changes.

As cloud usage continues to evolve, so must our security controls,” said Evelyn De Souza, Co-Chair of the CCM Working Group and also Data Center and Cloud Security Strategist with Cisco Systems. “We must now address the expanding methods of how cloud data is accessed to ensure due care is taken in the cloud service provider’s supply chain, and service disruption is minimized in the face of a change to a cloud service provider’s relationship. With the additional new key control domains and improved clarity, the CCM will become an increasingly important tool for providers and consumers to rely on to ensure greater transparency, trust, and security in the cloud.”

CCM Version 3.0 includes the following updates:

• Five new control domains that address information security risks over the access of, transfer to, and securing of cloud data: Mobile Security; Supply Chain Management, Transparency & Accountability; Interoperability & Portability; and Encryption & Key Management
• Improved harmonization with the Security Guidance for Critical Areas of Cloud Computing v3
• Improved control auditability throughout the control domains and an expanded control identification naming convention.