Financial, cloud security sectors collaborate on cyber threats

The Cyber Risk Institute, the Cloud Security Alliance, and the Bank Policy Institute have announced the release of a cloud extension for the CRI Profile version 1.2.

The "Cloud Profile" represents the collaboration of more than 50 financial institutions and major cloud service providers to extend the CRI Profile, which is a widely accepted cybersecurity compliance framework for the financial sector.

"Today's release marks an historic achievement," says CRI President Joshua Magri.

"This is the first time that financial institutions, the major CSPs, and trade associations have come together to develop a set of baseline expectations related to cybersecurity and roles and responsibilities for cloud deployment," he says.

"We are exceedingly proud of the work done here and what it may mean for future cloud usage in the financial services sector. We are pleased to be part of a collaborative solution to a longstanding challenge.

As more financial institutions move to the cloud, financial regulators globally have become increasingly focused on ensuring firms use sound risk management practices during cloud implementation. The Cloud Profile provides guidance to financial institutions and CSPs on commonly understood responsibilities related to cloud deployment across software-as-a-service, platform-as-a-service, and infrastructure-as-a-service delivery models.

"Financial regulators need clear, consistent, and timely information on firms' relationships with their third parties. The Cloud Profile helps clarify where a firm's responsibilities end and a cloud service provider's responsibilities begin," adds Chris Feeney, executive vice president of BPI and president of BPI-BITS.

"A common understanding of cybersecurity controls for cloud implementation that has been developed, vetted, and accepted by firms and CSPs is a sound approach in ensuring our financial sector is more secure," he says.

This guidance is designed to enable financial institutions and CSPs to come to contractual understanding more easily and should also facilitate more streamlined and secure processes for deploying cloud services.

"We are very happy to work with a like-minded organisation such as CRI, and we are excited about these initial results," says Daniele Catteddu, chief technology officer, Cloud Security Alliance.

"The Cloud Profile extension brings together the CRI Profile with the security controls and security shared responsibility model of the CSA Cloud Controls Matrix v4.0," she says.

"This represents a very powerful tool to support financial institutions in building a cloud security governance and compliance program that can meet their strict sectorial requirements."

CRI, CSA, and BPI will continue working on ways to leverage this joint framework and look forward to greater collaboration.