An organization wants a framework of cloud-specific security controls, mapped to other standards, to assess prospective cloud providers and its own cloud deployments. Which resource fits this purpose?
Select an answer to reveal the explanation.
Short Explanation
You want a checklist built for the cloud, not just a dictionary or a list of attacks. The CSA Cloud Controls Matrix is exactly that: cloud controls, organized into domains and mapped to other standards. NIST 800-145 just defines what cloud is, so don't let the NIST name fool you.
Full Explanation
The Cloud Security Alliance Cloud Controls Matrix is a cybersecurity control framework designed specifically for cloud computing. It organizes controls into domains covering areas such as identity and access management, data security, encryption and key management, and supply chain, indicates applicability to service models, and maps controls to other standards and regulations. Organizations use it to assess providers, often together with the related questionnaire, and to evaluate their own cloud programs. NIST SP 800-145 provides the widely used definition of cloud computing, including the essential characteristics, the three service models and the four deployment models; it is a vocabulary, not a catalog of security controls. The OWASP Top Ten describes the most critical web application security risks and is valuable for secure development, but it is not a cloud control framework and does not cover provider assessment. MITRE ATT&CK catalogs adversary tactics and techniques, including cloud matrices, and supports detection engineering and threat modeling, yet it describes attacker behavior rather than prescribing controls for assessing providers. Exam caveat: CSA also operates the STAR registry, where providers publish self-assessments and audit attestations based on the matrix. Operational check: select the matrix domains relevant to the workloads, request completed assessments from providers, and record gaps against each control.