2. Home
  3. Cloud Computing Certification
  4. CCSL
  5. CSA Attestation - OCF Level 2

CSA Attestation - OCF Level 2

Part 1 - General information
CSA Attestation - OCF Level 2
OCF Level 2
Cloud Security Alliance (CSA)

CSA Attestation - OCF Level 2
The CSA STAR Program has 2 components: 1) the Open Certification Framework Working Group which defined the technical specification for the certification and attestation schemes included in the STAR Program 2) the STAR Register which is the public registry that is used to provide to the general public information about the STAR Program and the results of the various certification assessments. CSA STAR Certification & STAR Attestation is one of the certification approach offered in the STAR Program and it is positioned at Level 2 of the OCF. The CSA STAR Program is under the direct control of the CSA. The CSA defines the technical specification of the Program based on the input coming from the OCF WG. The OCF WG has a research charter that is updated periodically (every 12-18 months). The charter defines the objectives of the WG, the requirements to become a member and the voting procedure. Moreover the CSA is supported by two advisory boards: Governance, Risk and Compliance (GRC) Stack Steering Committee and the OCF SC. These two SC provide strategic advice to the CSA and the OCF WG. As the scheme owner, the CSA plays the following functions: 1) defines the technical specifications for the assessments/audits procedures 2) defines the set of technical controls that are used during the assessment (the Cloud Control Matrix) 3) define the requirements, process and criteria for accrediting auditor to perform STAR Program related assessments 4) review on periodical basis the assessment performed by qualified auditor to verify the proper implementation of the scheme and the conformity with applicable code of ethics 5) collects feedback and complaints from the users. To maintain the necessary level of independence and separation of duties, the CSA is NOT involved in the audit process.
an organisation, one or more services, set of business processes

CSA Attestation - OCF Level 2
Part 2 - Underlying information security standard or best practices
STAR Attestation is based on the Cloud Controls Matrix, AICPA Trust Services Principles & Criteria and AICPA AT 101
Cloud Security Alliance (CSA) for CCM AICPA for Trust Service Principle & Criteria, AT 101
control objectives, detailed technical requirements, other (describe briefly)
CCM is structured in 16 domains and composed of 133 security controls. Attestation is based on AICPA Trust Services Principles & Criteria: 5 principles and 7 Criteria.
PaaS, IaaS, SaaS, Organization (processes, policies)
public and free
yes (description below)
STAR Attestation is based on: - Cloud Control Matrix - SOC 2 (AT 101)
STAR Attestation is based on SOC 2 therefore is a “period of time” type of assessment vs. the “point in time” type of assessment of ISO27001. In essence in a SOC 2 audit the auditors are assessing the effectiveness of a controls over a period of time. Like in the case of STAR Certification, even STAR Attestation support SOC 2 assessment with cloud relevant controls coming from CCM. Examples of requirements from CCM are: Ex.1 DOMAIN: Encryption & Key Management (EKM) CCM Control: EKM-04_Storage and Access: Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties. Ex.2 DOMAIN: Infrastructure & Virtualization Security CCM Control: IVS-04: Capacity / Resource Planning: The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload. For SOC 2 requirements please refer to https://resilience.enisa.europa.eu/cloud-computing-certification/list-of-cloud-certification-schemes/service-organization-control-soc-2-report
Part 3 - Assessments and certification of compliance
STAR Attestation is based on type 2 SOC attestations supplemented by the criteria in the Cloud Controls Matrix. STAR Attestation builds on the key strengths of SOC 2 (AT 101): - Is a mature attest standard (it serves as the standard for SOC 2 and SOC 3 reporting) - Provides for robust reporting on the service provider’s description of its system and on the service provider’s controls, including a description of the service auditor’s tests of controls in a format very similar to the now obsolete SAS 70 reporting format and current SSAE 16 (SOC 1) reporting, thereby facilitating market acceptance - Evaluation over a period of time rather than a point in time This assessment: - Allows for immediate adoption of the CCM as additional criteria and the flexibility to update the criteria as technology and market requirements change - Does not require the use of any criteria that were not designed for, or readily accepted by cloud providers
A SOC 2 audit can only performed by an independent certified public accountant (CPA) or firm (e.g. Brightline, Deloitte, EY, ISG, KPMG).
The auditors have to be Certified Public Accountants (CPAs).
training, information sessions, courses, diplomas
yes (link below)
no
no
other (describe briefly)
Continuous monitoring is part of OCF framework but not part of OCF Level 2. OCF Level 3: CSA STAR Continuous Monitoring enables automation of the current security practices of cloud providers. Providers publish their security practices according to CSA formatting and specifications, and customers and tool vendors can retrieve and present this information in a variety of contexts.
yes - provide a link to an example
yes - provide a link to an example
yes (description below)
Reviewed every year based on relevant input provided by the information security experts.
yes (description below)
It is mandatory to perform an audit at least once per year.
Part 4 - Current adoption and usage
The CSA STAR Program and its underlying technical standards are globally and widely adopted by CSP, Cloud Customers and Governments.
92
global
global
Part 5 - Security objectives
Application & Interface Security
Description:

CSA CCM Control Domain 1 - Application & Interface Security controls: Application Security, Customer Access Requirements, Data Integrity, Data Security / Integrity

References:

AIS-01, AIS-02, AIS-03, AIS-04

Audit Assurance & Compliance
Description:

CSA CCM Control Domain 2 - Audit Assurance & Compliance controls: Audit Planning, Independent Audits, Information System Regulatory Mapping

References:

AAC-01, AAC-02, AAC-03

Business Continuity Management & Operational Resilience
Description:

CSA CCM Control Domain 3 - Business Continuity Management & Operational Resilience controls: Business Continuity Planning, Business Continuity Testing, Datacenter Utilities / Environmental Conditions, Documentation, Environmental Risks, Equipment Location, Equipment Maintenance, Equipment Power Failures, Impact Analysis, Policy, Retention Policy

References:

BCR-01, BCR-02, BCR-03,BCR-04, BCR-05, BCR-06, BCR-07, BCR-08, BCR-09, BCR-10, BCR-11

Change Control & Configuration Management
Description:

CSA CCM Control Domain 4 - Change Control & Configuration Management controls: New Development / Acquisition, Outsourced Development, Quality Testing, Unauthorized Software Installations, Production Changes

References:

CCC-01, CCC-02, CCC-03, CCC-04, CCC-05

Data Security & Information Lifecycle Management
Description:

CSA CCM Control Domain 5 - Data Security & Information Lifecycle Management controls: Classification, Data Inventory / Flows, eCommerce Transactions, Handling / Labeling / Security Policy, Non-Production Data, Ownership / Stewardship, Secure Disposal

References:

DSI-01, DSI-02, DSI-03, DSI-04, DSI-05, DSI-06, DSI-07

Datacenter Security
Description:

CSA CCM Control Domain 6 - Datacenter Security controls: Asset Management, Controlled Access Points, Equipment Identification, Off-Site Authorization, Off-Site Equipment, Policy, Secure Area Authorization, Unauthorized Persons Entry, User Access

References:

DCS-01, DCS-02, DCS-03, DCS-04, DCS-05, DCS-06, DCS-07, DCS-08, DCS-09

Encryption & Key Management
Description:

CSA CCM Control Domain 7 - Encryption & Key Management controls: Entitlement, Key Generation, Sensitive Data Protection, Storage and Access

References:

EKM-01, EKM-02, EKM-03, EKM-04

Governance and Risk Management
Description:

CSA CCM Control Domain 8 - Governance and Risk Management controls: Baseline Requirements, Data Focus Risk Assessments, Management Oversight, Management Program, Management Support/Involvement, Policy, Policy Enforcement, Policy Impact on Risk Assessments, Policy Reviews, Risk Assessments, Risk Management Framework

References:

GRM-01, GRM-02, GRM-03, GRM-04, GRM-05, GRM-06, GRM-07, GRM-08, GRM-09, GRM-10, GRM-11

Human Resources
Description:

CSA CCM Control Domain 9 - Human Resources controls: Asset Returns, Background Screening, Employment Agreements, Employment Termination, Mobile Device Management, Non-Disclosure Agreements, Roles / Responsibilities, Technology Acceptable Use, Training / Awareness, User Responsibility, Workspace

References:

HRS-01, HRS-02, HRS-03, HRS-04, HRS-05, HRS-06, HRS-07, HRS-08, HRS-09, HRS-10, HRS-11

Identity & Access Management
Description:

CSA CCM Control Domain 10 - Identity & Access Management controls: Audit Tools Access, Credential Lifecycle / Provision Management, Diagnostic / Configuration Ports Access, Policies and Procedures, Segregation of Duties, Source Code Access Restriction, Third Party Access, Trusted Sources, User Access Authorization, User Access Reviews, User Access Revocation, User ID Credentials, Utility Programs Access

References:

IAM-01, IAM-02, IAM-03, IAM-04, IAM-05, IAM-06, IAM-07, IAM-08, IAM-09, IAM-10, IAM-11,IAM-12,IAM-13

Infrastructure & Virtualization Security
Description:

CSA CCM Control Domain 11 - Infrastructure & Virtualization Security controls: Audit Logging / Intrusion Detection, Change Detection, Clock Synchronization, Information System Documentation, Vulnerability Management, Network Security, OS Hardening and Base Controls, Production / Non-Production Environments, Segmentation, VM Security - vMotion Data Protection, VMM Security - Hypervisor Hardening, Wireless Security, Network Architecture

References:

IVS-01, IVS-02, IVS-03, IVS-04, IVS-05, IVS-06, IVS-07, IVS-08, IVS-09, IVS-10, IVS-11,IVS-12,IVS-13

Interoperability & Portability
Description:

CSA CCM Control Domain 12 - Interoperability & Portability controls: APIs, Data Request, Policy & Legal, Standardized Network Protocols, Virtualization

References:

IPY-01, IPY-02, IPY-03, IPY-04, IPY-05

Mobile Security
Description:

CSA CCM Control Domain 13 - Mobile Security controls: Anti-Malware, Application Stores, Approved Applications, Approved Software for BYOD, Awareness and Training, Cloud Based Services, Compatibility, Device Eligibility, Device Inventory, Device Management, Encryption, Jailbreaking and Rooting, Legal, Lockout Screen, Operating Systems, Passwords, Policy, Remote Wipe, Security Patches, Users

References:

MOS-01,MOS-02,MOS-03,MOS-04,MOS-05,MOS-06,MOS-07,MOS-08,MOS-09,MOS-10,MOS-11,MOS-12,MOS-13 to MOS-20

Security Incident Management, E-Discovery & Cloud Forensics
Description:

CSA CCM Control Domain 14 - Security Incident Management, E-Discovery & Cloud Forensics controls: Contact / Authority Maintenance, Incident Management, Incident Reporting, Incident Response Legal Preparation, Incident Response Metrics

References:

SEF-01, SEF-02, SEF-03, SEF-04, SEF-05

Supply Chain Management, Transparency and Accountability
Description:

CSA CCM Control Domain 15 - Supply Chain Management, Transparency and Accountability controls: Data Quality and Integrity, Incident Reporting, Network / Infrastructure Services, Provider Internal Assessments, Supply Chain Agreements, Supply Chain Governance Reviews, Supply Chain Metrics, Third Party Assessment, Third Party Audits

References:

STA-01, STA-02, STA-03, STA-04, STA-05, STA-06, STA-07, STA-08, STA-09

Threat and Vulnerability Management
Description:

CSA CCM Control Domain 16 - Threat and Vulnerability Management controls: Anti-Virus / Malicious Software, Vulnerability / Patch Management, Mobile Code

References:

TVM-01, TVM-02, TVM-03