2. Cloud Governance
Good cloud governance means setting clear rules and policies to keep cloud use safe, legal, and efficient. It includes:
- Assigning who does what
- Finding out what you need
- Handling risks
- Labeling data and stuff
- Following laws and rules
- Keeping a cloud inventory
- Setting up a management chain
- Using cloud-specific security tools
Policies = high-level rules to follow.
Control Objectives = specific goals (like “require MFA”).
Control Specifications = how to technically do it (e.g., “enable MFA + enforce via policy”).
The CSA Cloud Controls Matrix (CCM):
- is a cloud-specific framework with control domains covering governance, risk, operations, and data privacy.
- It’s aligned with major standards like ISO, PCI, and NIST. making it easy to map to compliance. Think of it as a checklist for cloud security.
Security, Trust, Assurance, and Risk (STAR):
- is a CSA framework that helps organizations assess and manage cloud security, trust, assurance, and risk, especially for cloud services.
- It’s used to evaluate cloud providers and ensure they meet security and compliance standards.
| Feature | CSA Cloud Controls Matrix (CCM) | Security, Trust, Assurance, and Risk (STAR) |
|---|---|---|
| Purpose | Define cloud security controls and compliance | Assess cloud provider security and trust |
| Focus | Internal governance and control implementation | External provider evaluation and risk management |
| Use Case | Build your own cloud security policies | Evaluate cloud vendors before choosing them |
| Standards Alignment | ISO, PCI, NIST | ISO, PCI, NIST (similar, but STAR is more vendor-focused) |
| Output | Control objectives and specifications | Risk ratings, trust scores, assurance reports |