ChaptersEventsBlog

CSA Research

Best practices, guidance, frameworks and tools to help the industry secure the cloud. Read our research to get your questions around cloud security answered.
Research

CSA Research is created by the industry for the industry and is both vendor-neutral and consensus driven. Our research is created by subject matter experts who volunteer for our working groups. Each working group focuses on a unique topic or aspect of cloud security, from IoT, DevSecOps, Serverless and more, we have working groups for over 20 areas of cloud computing. You can view a list of all active research working groups. To find out more about how our research is created and the process we follow you can view the CSA Research Lifecycle.

Contribute to CSA Research

Peer reviews allow security professionals from around the world to collaborate on CSA research. Provide your feedback on the following documents in progress.

Latest Research

The State of Non-Human Identity and AI Security

The State of Non-Human Identity and AI Security

Release Date: 01/26/2026

Based on a comprehensive survey of IT and security professionals, this report explores how rapid AI adoption amplifies long-standing Identity and Access Management (IAM) challenges. It reveals that AI does not introduce an entirely new identity paradigm. Instead, AI magnifies existing non-human...
CCM-Lite and CAIQ-Lite

CCM-Lite and CAIQ-Lite

Release Date: 01/26/2026

The Cloud Security Alliance, in collaboration with the CCM Working Group, proudly presents the CCM-Lite and CAIQ-Lite File Bundle. These tools offer a streamlined way to assess cloud security.

CCM-Lite: 

The CCM-Lite is a simplified version of the Cloud Controls Matrix (CCM) v4. It includes...
Cloud Controls Matrix and CAIQ v4

Cloud Controls Matrix and CAIQ v4

Release Date: 01/25/2026

The Cloud Controls Matrix (CCM) is a cybersecurity control framework that maps to industry best practices and is considered the standard for cloud security and privacy. The accompanying CAIQ provides a set of “yes/no” questions to assess security controls. Download both the CCM and CAIQ here.

...