The Cyber Risk Institute (CRI), the Cloud Security Alliance (CSA), and the Bank Policy Institute-BITS announced today the release of a cloud extension for the CRI Profile version 1.2. The "Cloud Profile" represents the collaboration of over 50 financial institutions and major cloud service providers (CSPs) to extend the CRI Profile, which is a widely accepted cybersecurity compliance framework for the financial sector.

"Today's release marks an historic achievement," said CRI President Joshua Magri. "This is the first time that financial institutions, the major CSPs, and trade associations have come together to develop a set of baseline expectations related to cybersecurity and roles and responsibilities for cloud deployment. We are exceedingly proud of the work done here and what it may mean for future cloud usage in the financial services sector. We are pleased to be part of a collaborative solution to a longstanding challenge."

As more financial institutions move to the cloud, financial regulators globally have become increasingly focused on ensuring firms use sound risk management practices during cloud implementation. The Cloud Profile provides guidance to financial institutions and CSPs on commonly understood responsibilities related to cloud deployment across software-as-a-service, platform-as-a-service, and infrastructure-as-a-service delivery models.

"Financial regulators need clear, consistent, and timely information on firms' relationships with their third parties. The Cloud Profile helps clarify where a firm's responsibilities end and a cloud service provider's responsibilities begin," said Chris Feeney, Executive Vice President of BPI and President of BPI-BITS. "A common understanding of cybersecurity controls for cloud implementation that has been developed, vetted, and accepted by firms and CSPs is a sound approach in ensuring our financial sector is more secure."

This guidance is designed to enable financial institutions and CSPs to come to contractual understanding more easily and should also facilitate more streamlined and secure processes for deploying cloud services.

"We are very happy to work with a like-minded organization such as CRI, and we are excited about these initial results. The Cloud Profile extension brings together the CRI Profile with the security controls and security shared responsibility model of the CSA Cloud Controls Matrix v4.0. This represents a very powerful tool to support financial institutions in building a cloud security governance and compliance program that can meet their strict sectorial requirements," said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance.