CloudTrust Protocol Information Overview (pdf) - Cloud Security ...

A Complete Cloud Security Governance, Risk, andCompliance (GRC) StackCloudTrust Protocol (CTP) Included Within CSA GRC StackGovernment Specs Extensions Commercial???Deliver “continuousmonitoring” required byA&A methodologiesContinuous monitoring … witha purpose• Common technique and nomenclatureto request and receive evidence andaffirmation of controls from cloudproviders???Claims, offers, and the basisfor auditing service delivery• Common interface and namespace toautomate the Audit, Assertion,Assessment, and Assurance (A6) ofcloud environments• FedRAMP• DIACAP• Other C&A standardsPre-audit checklists andquestionnaires to inventorycontrols• Industry-accepted ways to documentwhat security controls existNIST 800-53, HITRUST CSF,ISO 27001/27002, ISACACOBIT, PCI, HIPAA, SOX,GLBA, STIG, NIST 800-144,SAS 70, …The recommendedfoundations for controls• Fundamental security principles inassessing the overall security risk of acloud providerCloudTrust Protocol Orientation | Ron Knode | CTP to CSA6 June 2011 Page 8