An enterprise architect wants a cloud security reference model that organizes required capabilities into domains such as business operation support services, IT operations and services, and security and risk management, so that gaps in a cloud program can be mapped against it. Which reference best fits?

The CSA Enterprise Architecture, originally developed as the Trusted Cloud Initiative reference architecture, is a methodology and set of tools for designing and assessing cloud security. It organizes security capabilities into domains that include business operation support services, IT operations and services, security and risk management, and technology solution services covering presentation, application, information and infrastructure. Architects use it to compare an existing or planned cloud program against a complete capability set and to identify gaps. NIST SP 800-145 provides the definition of cloud computing, its essential characteristics, service models and deployment models; it is vocabulary, not a capability architecture. ISO/IEC 27001 specifies requirements for an information security management system and is a certifiable management standard, but it does not organize capabilities into a cloud reference architecture with these domains. The CSA STAR registry is a public repository of provider self-assessments and third-party certifications used for provider assurance, not a design reference. Exam caveat: the outline lists the CSA Enterprise Architecture next to SANS security principles, the Well-Architected Framework and secure by design as cloud design patterns, each serving a different purpose. Operational check: map current controls to each capability domain and record every unmapped capability as a gap with an owner.