Highlights –

  • The joint trade built the Cloud Profile, keeping in mind the financial sector and a cloud service provider’s responsibilities.
  • The new release will provide guidance on cybersecurity and roles and responsibilities for cloud deployment.
  • The CRI profile supports financial institutions in building a cloud security governance and compliance program.

The Cyber Risk Institute (CRI), the Cloud Security Alliance (CSA), and the Bank Policy Institute-BITS have collaborated to announce the release of a cloud extension for the CRI Profile version 1.2. The ‘Cloud Profile’ depicts the partnership of over 50 financial institutions and major Cloud Service Providers (CSPs) to extend the CRI Profile, a widely accepted cybersecurity compliance framework for the financial sector.

“Today’s release marks a historic achievement,” said CRI President Joshua Magri. “This is the first time that financial institutions, the major CSPs, and trade associations have come together to develop a set of baseline expectations related to cybersecurity and roles and responsibilities for cloud deployment. We are exceedingly proud of the work done here and what it may mean for future cloud usage in the financial services sector. We are pleased to be part of a collaborative solution to a longstanding challenge.”

With more and more financial institutions migrating to the cloud, financial regulators increasingly focus on ensuring firms use sound risk management practices during cloud implementation. The Cloud Profile will guide financial institutions, and CSPs on commonly understood responsibilities about cloud deployment across platform-as-a-service, software-as-a-service, and infrastructure-as-a-service delivery models.

“Financial regulators need clear, consistent, and timely information on firms’ relationships with their third parties. The Cloud Profile helps clarify where a firm’s responsibilities end and a cloud service provider’s responsibilities begin,” said Chris Feeney, Executive Vice President of BPI and President of BPI-BITS. “A common understanding of cybersecurity controls for cloud implementation that has been developed, vetted, and accepted by firms and CSPs is a sound approach in ensuring our financial sector is more secure.”

This initiative is aimed to enable financial institutions and CSPs to come to contractual understanding more easily and facilitate more streamlined and secure processes for delivering cloud services.

“We are very happy to work with a like-minded organization such as CRI, and we are excited about these initial results. The Cloud Profile extension brings together the CRI Profile with the security controls and security shared responsibility model of the CSA Cloud Controls Matrix v4.0. This represents a very powerful tool to support financial institutions in building a cloud security governance and compliance program that can meet their strict sectorial requirements,” said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance.

CRI, CSA, and BPI will continue working on leveraging this joint framework and look forward to greater collaboration.