CSA Blog

Originally published by RegScale. If you’ve ever managed enterprise compliance, you know the drill all too well. It’s the night before the audit deadline and you’re drowning in spreadsheets, frantically gathering evidence. It’s 2025 — but you feel like you’re still doing compliance...

If you had to pick a single control that changes the game for cloud security, you might want to choose killing standing privileges. Identity is now the easiest way in for attackers. Gartner has warned that mismanagement of identities, access, and privilege will be the top reason...

Since its introduction in 2010, the Cloud Controls Matrix (CCM) has become a cornerstone of cloud security and compliance worldwide. Adopted across industries and geographies, it has enabled cloud service providers and cloud customers alike to evaluate their security posture...

Before I get into the meat of this post, I want to emphasize that I am a huge fan of MCP (Model Context Protocol) servers and I believe the technology offers more than enough value to justify its use in the enterprise. But, like everything else on the planet, MCP is a double...

Resiliency through multicloud looks great on paper, but the reality is far more complex (and expensive). Thanks to Amazon, Microsoft, and Google, my calendar over the past few weeks spiked with members calling to discuss cloud resiliency. Each of these outages was rare, and...

Microsoft and Zendesk recognized as first organizations to achieve STAR for AI Level 2 certification SEATTLE – November 20, 2025 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure...

Originally published by Schellman. With proven real-life use cases, it’s a no-brainer that companies are looking for ways to integrate large language models (LLMs) into their existing offerings to generate content. A combination that’s often referred to as Generative AI, LLMs...

Written by Ben Brigida, Expel. This blog is based on a recent session where Ray and I (Ben) discussed the key aspects to measuring security operations center (SOC) effectiveness. Over the years leading SOCs, I've learned that measuring success is one of the toughest challenges...

The landscape of AI governance continues to evolve rapidly, presenting significant challenges for organizations trying to establish robust compliance frameworks. The Cloud Security Alliance (CSA) has introduced an initial version of the STAR for AI Level 2 designation, which...

The Cloud Controls Matrix (CCM) is a framework of controls that are essential for cloud computing security. Created by CSA, the CCM aligns with CSA best practices. You can use CCM to assess and guide the security of any cloud service. CCM also provides guidance on which actors...

Written by Sunil Gentyala, Lead Cybersecurity & AI Security Engineer, HCLTech. Abstract The proliferation of distributed applications across public cloud, hybrid cloud, private cloud, and on-premises infrastructure necessitates advanced security mechanisms to protect inter...

Originally published by TrojAI. The new security blind spot Voice-driven AI is moving quickly from science fiction to daily reality as we move from GenAI models to more sophisticated applications and agents. Once relegated to smart speakers and novelty gadgets, voice AI...

“Store Now, Decrypt Later," or SNDL, attacks are a unique brand of attack that you need to keep top-of-mind in the coming years. Our new publication, A Practitioner’s Guide to Post-Quantum Cryptography, lays out why SNDL is so different. Exploitation may start today and only...

As AI becomes more powerful and accessible, the stakes around data privacy and protection are higher than ever. For instance, a single employee, seeking to leverage AI’s ability to read and understand a PDF, can easily upload a confidential document to an LLM and, in doing...

If you still run threat modeling as a one-time design activity, you’re missing the whole point of the cloud. Modern environments are elastic, multi-account, API-driven, and (thanks to AI) constantly changing. The attack surface is always reshaping itself. CSA’s new Cloud Threat...