The cloud has revolutionized business, but it has also brought complex compliance challenges. Managing the security posture of cloud infrastructure is a crucial aspect of maintaining your cloud operations while addressing compliance mandates.

As revealed in the 2024 Global Threat Report, cloud intrusions increased by 75% in 2023, with a 110% YoY increase in "cloud-conscious" threat actors. Adversary techniques continue to grow more sophisticated for initial access, lateral movement, privilege escalation, defense evasion, and data collection.

Without a cloud security framework, organizations lack the in-depth visibility needed to determine if that data is adequately secured. Failing to maintain this visibility leaves you vulnerable to data exposure, unauthorized access, and other security threats. You can mitigate risks and protect your data in the cloud by selecting the appropriate framework and implementing best practices such as risk assessment, security controls, and incident response.

A cloud security framework also guarantees that all critical components of your cloud infrastructure are not only compliant but secure, reducing the opportunity for a cyberattack. With a cloud security framework mapped to your organization’s compliance needs, you can effectively implement right-fit security and privacy controls to address the relevant regulatory requirements in the cloud.

This post will explore the ways cloud security frameworks help support the security and compliance of data and apps in cloud computing environments.

What is a cloud security framework?

Cloud security frameworks are sets of guidelines, best practices, and controls organizations use to approach the security of their data, applications, and infrastructure in cloud computing environments. They provide a structured approach to identifying potential risks and implementing security measures to mitigate them.

Cloud security frameworks focus on the security aspects that are crucial for addressing compliance and governance requirements, but the focus is on maintaining security rather than achieving compliance or governance. Some of these frameworks provide the security controls necessary to meet relevant security standards and regulations, but they are not all-inclusive when it comes to compliance.

Cloud compliance vs cloud governance frameworks

Cloud security frameworks, cloud compliance frameworks, and governance frameworks are similar but serve different purposes in cloud computing environments.

Cloud security frameworks address the unique security challenges of the cloud, including the shared responsibility models and facilitating the identification and mitigation of potential risks.

On the other hand, cloud compliance frameworks ensure that organizations comply with legal and regulatory requirements for cloud services, focusing on specific compliance requirements, such as HIPAA, PCI-DSS, or GDPR. They outline the necessary controls and measures to achieve compliance.

Governance frameworks are broader in scope and address the overall management and oversight of IT systems, including cloud environments. They define policies, procedures, and guidelines for decision-making, risk management, and compliance, providing a framework for making sure IT resources are used effectively and efficiently.

Although there may be some overlap between the three frameworks, each serves a distinct purpose in managing and securing cloud environments.

Most common cloud frameworks

As more organizations adopt cloud computing services, ensuring the security and compliance of data and applications becomes increasingly challenging. Cloud security frameworks offer up guidance and controls to help organizations identify potential risks and implement security measures to mitigate those risks.

Not all frameworks and associated requirements are relevant to every industry. In addition, organizations that adopt regulatory compliance frameworks also require to meet these objectives for applications in the cloud. This section will explore key frameworks that can help organizations comply with various security and privacy regulations when using cloud services.

Cloud security frameworks

• MITRE ATT&CK
• Center for Internet Security (CIS)
• CSA STAR
• ISO/IEC 27017:2015
• Other Frameworks

MITRE ATT&CK

As a framework, MITRE ATT&CK standardizes the different stages of an attack. Rather than focusing just on controls, it targets tactics and techniques employed by hackers in the cloud. Using this framework, organizations can understand the potential attack vectors, strengthening their security posture in the cloud through improved detection and response capabilities.

CIS

The Center for Internet Security (CIS) is well-known throughout the industry for offering standardized controls and benchmarks that serve as a compliance standard for creating a security baseline. These benchmarks started out targeting on-premises systems but have evolved to include technologies for the top cloud providers as well.

Part of what makes the CIS standard unique is that it is built from a consensus of practitioners developing from a trusted and tested set of effective defenses in production environments; this has led to a more effective control set.

CSA STAR

The Cloud Security Alliance’s Security Trust Assurance and Risk (CSA STAR) framework provides cloud security best practices and validates the security posture of cloud service providers. The framework itself outlines both the cloud-specific security controls for cloud providers as part of the Cloud Control Matrix (CCM). In addition, it also provides customers who run applications on these clouds a list of questions to ensure they can assess their CCM compliance

ISO/IEC 27017:2015

ISO 27001 encompasses guidelines that can help customers put in place a framework to manage risks related to protection of data both owned and handled across the company.

ISO 27017 is a cloud specific framework that provides guidance on the information security aspects specific to the cloud.The security controls provided in this framework supplement the guidance of the ISO/IEC 27002 and ISO/IEC 27001 standards. The framework also provides distinct security controls and implementation guidance for both cloud service providers as well as applications

Other frameworks

Cloud Service Providers themselves have been publishing their own frameworks that combine cloud specific controls from several security and regulatory frameworks. These include frameworks like AWS Foundation Security Best Practices Standard and Microsoft cloud security benchmarks.

Regulatory compliance and standards frameworks

• General Data Protection Regulation (GDPR)
• FedRAMP
• ISO 27001
• Payment Card Industry Data Security Standard (PCI DSS)
• HIPAA and HITECH
• Sarbanes-Oxley (SOX)
• California Consumer Privacy Act (CCPA)
• Federal Information Security Modernization Act (FISMA)
• NERC CIP
• NIST CSF
• System and Organization Controls 2 (SOC 2)
• Cybersecurity Maturity Model Certification 2.0 (CMMC 2.0)
• Generic Frameworks

General Data Protection Regulation (GDPR)

GDPR is a comprehensive set of privacy and data protection regulations imposed on organizations handling the personal data of EU residents. It contains specific security and privacy considerations related to using cloud services.

These controls include Data Protection Impact Assessments (DPIAs), maintaining data subjects’ rights to their data, security controls for protecting data, and data transfer safeguards to limit data leaving the EU.

Federal Risk and Authorization Management Program (FedRAMP)

FedRAMP is a crucial component of cloud security frameworks, particularly for cloud service providers seeking to do business with U.S. government agencies. It standardizes how non-government entities implement security controls to ensure they align with government standards for assessment, authorization, and monitoring in the cloud.

ISO 27001

ISO 27001, from the International Organization for Standardization (ISO), is the de facto international set of guidelines for standardizing the full lifecycle of an information security management system (ISMS). It ensures that organizations have a structured approach to managing sensitive information.

ISO 27001 provides organizations with specific security and privacy considerations regarding cloud computing, such as performing risk assessments, implementing security controls, and continuously improving security measures.

Payment Card Industry Data Security Standard (PCI DSS)

PCI DSS, unlike most other standards, is dictated by the payment card industry rather than a government entity. It sets baselines for how merchants and service providers securely handle credit card data, explicitly outlining what security controls are necessary to protect against data breaches. The standard comprises several key components: scope determination, security controls, third-party service provider management, and compliance validation.

Health Insurance Portability and Accountability Act (HIPAA)/Health Information Technology for Economic and Clinical Health Act (HITECH Act)

HIPAA and HITECH are United States federal laws that establish security and privacy standards for protecting patients’ electronic protected health information (ePHI). Compliance with these laws is critical for healthcare organizations to ensure the confidentiality, integrity, and availability of ePHI on-premises and in the cloud. It uses a combination of risk assessments, security controls, privacy controls, business associate agreements, and compliance validation.

Sarbanes-Oxley (SOX)

SOX is a federal law in the United States that created requirements for financial reporting and corporate governance. It ensures the accuracy and completeness of companies’ financial information, requiring them to establish and maintain adequate internal controls over financial reporting.

Core SOX components that organizations must adhere to include risk assessments, continuous control activities, securing confidential communication, and monitoring internal controls on financial reporting. These components ensure that companies have appropriate measures to detect and prevent fraud, misstatements, and other financial malpractice that could harm the company’s reputation, financial stability, and overall public trust.

California Consumer Privacy Act (CCPA).

CCPA is a privacy law similar to GDPR but for the protection of California residents’ personal information. It requires businesses to establish reasonable security measures to protect personal data. Compliance involves a combination of data inventory and mapping, risk assessments, robust security controls, incident response plans, and maintaining audit trails of policy adherence.

Federal Information Security Modernization Act (FISMA)

FISMA is a law in the United States aimed at federal agencies for the purpose of creating information security programs. FISMA takes a risk-based approach to data protection, setting minimum security baselines for agencies to follow. FISMA seeks to protect federal data and information systems using five critical components: security categorization, risk assessment, security controls, continuous monitoring, and compliance validation.

North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP)

NERC CIP standards are designed to protect the North American power grid from cyberattacks. They apply to all organizations responsible for the bulk electric system (BES), including generation facilities, transmission and distribution systems, and power utilities. Its core components include risk management, security controls, incident response programs, and compliance validation.

National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF)

NIST CSF is a comprehensive set of guidelines and best practices for securing cloud-based systems. It helps organizations assess and manage the security risks associated with cloud computing through its core functions: Identify, Protect, Detect, Respond, and Recover. These pillars include numerous controls to effectively manage cybersecurity risks in a cloud environment.

System and Organization Controls 2 (SOC 2)

The SOC 2 framework offers guidelines from the American Institute of Certified Public Accountants (AICPA) to evaluate the security, availability, processing integrity, confidentiality, and privacy of cloud service providers.

SOC 2 compliance involves an independent audit of a cloud service provider’s systems and controls to ensure they meet the SOC 2 requirements for policies and procedures, risk assessments, security controls, and independent audits.

Cybersecurity Maturity Model Certification 2.0 (CMMC 2.0)

CMMC was created by the U.S. Department of Defense (DoD) to ensure that contractors and suppliers working with the DoD have appropriate cybersecurity measures in place. This framework comes in multiple levels based on the extent of independently audited security controls implemented by suppliers. These levels are used in DoD contracts to block organizations that have not achieved the stated baselines from bidding.

CMMC 2.0 includes specific requirements for cloud security regarding cloud security controls, third-party control validation, monitoring, and compliance certification.

Generic frameworks

Other frameworks, such as COBIT 5 and COSO, provide security guidance but do not specifically offer cloud guidance. As these frameworks are more generic, applying their advice on security guidance may require some modification for a cloud environment. These frameworks still follow a common theme of assessing risks and vulnerabilities to establish control baselines and meet compliance mandates.

Best practices

Ensuring appropriate controls are in place to meet regulatory requirements is critical when selecting a cloud security framework that aligns with your business’s needs. Although each framework may have unique methods of securing cloud resources, there are some standard best practices that all companies should follow:

• Establish a risk assessment strategy to help identify potential threats and vulnerabilities, prioritize response efforts, and establish appropriate security controls to protect against risks.
• Enforce policies and procedures to mitigate risks and maintain compliance with regulatory requirements.
• Implement monitoring to facilitate early detection, drive rapid response to threats, and minimize any impact by stopping attacks before they escalate.

Businesses must keep reviewing their compliance practices to ensure they are up-to-date with changing regulations and security threats for their industry vertical. By implementing these best practices, companies can establish a robust security and privacy framework to secure their cloud environment and address compliance requirements.

CrowdStrike helps you meet your regulatory needs

CrowdStrike recognizes that compliance and certification frameworks are critical to any organization. CrowdStrike can help you meet these requirements, providing you with confidence regarding safe, smooth operation. External validation and accreditation is critically important to organizations that rely on CrowdStrike’s capabilities and technology to secure their data and comply with regulatory requirements.

Only CrowdStrike can deliver the world’s most comprehensive cloud detection and response, enforcing a security posture and compliance specific to different industries and regulations. CrowdStrike Falcon® Cloud Security has one of the highest MITRE ATT&CK detection coverage of 99% for cloud workloads, containers, and serverless environments, as well as 24/7 managed MDR and cloud threat hunting solution designed for workloads and containers. Its CNAPP capabilities offer both pre-runtime container image scanning and runtime protection that fully integrates with data from the control plane. You also get fully integrated market-leading threat intel allowing for real-time detection and response.

CrowdStrike Falcon® Cloud Security is the industry’s only cloud-native application protection platform (CNAPP) providing unified visibility and security for multi-cloud and hybrid environments with a single platform and one-click deployment. It delivers consistent security policies and helps to ensure compliance across on-premises, hybrid, and multi-cloud environments.

Get a free, no-obligation Cloud Security Health Check from CrowdStrike for your cloud infrastructure and cloud application environment to receive insights into your specific application’s security and regulatory needs.