CISA Cloud Security Technical Reference Architecture v2.0
CISA's cloud security reference architecture for federal agencies: FedRAMP continuous monitoring and incident communication, secure cloud migration with DevSecOps and centralised services, and cloud security posture management across governance, identity, data, infrastructure, monitoring, APIs, logging and automated deployment.
CISA Cloud Security Technical Reference Architecture v2.0 is a compliance framework from United States with 3 domains and 26 controls. The largest domains are Section 5: Cloud security posture management – CISA Cloud Security Technical Reference Architecture v2.0 (14 controls), Section 4: Cloud migration – CISA Cloud Security Technical Reference Architecture v2.0 (9 controls), Section 3: Shared services, service models and FedRAMP – CISA Cloud Security Technical Reference Architecture v2.0 (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Section 3: Shared services, service models and FedRAMP – CISA Cloud Security Technical Reference Architecture v2.0
| Code | Title |
|---|---|
| cisa-cloud-security-technical-reference-architecture-v2-0::3.3a | Continuously monitor cloud services after authorisation, covering what the provider does not and sharing the work across agencies |
| cisa-cloud-security-technical-reference-architecture-v2-0::3.3b | Report and communicate cloud incidents promptly, including suspected ones |
| cisa-cloud-security-technical-reference-architecture-v2-0::3.3c | Define the authorisation boundary and settle data location expectations with the provider |
Section 4: Cloud migration – CISA Cloud Security Technical Reference Architecture v2.0
| Code | Title |
|---|---|
| cisa-cloud-security-technical-reference-architecture-v2-0::4.1 | Design software for the cloud with security built in from the start of the life cycle |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.2 | Set a cloud migration strategy that weighs challenges, benefits and the right migration pattern per application |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.3 | Run each migration through plan, design, pilot, migrate and maintain |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.4a | Make DevSecOps the primary approach, with CI/CD and infrastructure as code |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.4b | Test security automatically in the pipeline and layer expert, third-party and public vulnerability disclosure on top |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.4c | Enforce least privilege, attribute-based access and two-person code review in DevSecOps teams |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.5a | Centralise common cloud services: an agency platform, gold images, artefact repositories, encryption and key services |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.5b | Centralise development tools, public-facing protections and security services such as logging and single sign-on |
| cisa-cloud-security-technical-reference-architecture-v2-0::4.6 | Invest in people: train, hire, procure, support staff and give timely access |
Section 5: Cloud security posture management – CISA Cloud Security Technical Reference Architecture v2.0
| Code | Title |
|---|---|
| cisa-cloud-security-technical-reference-architecture-v2-0::5.1 | Use cloud security posture management continuously and as an enabler of zero trust |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.2a | Govern cloud use against statutes, regulations, policies and standards across the whole service life cycle, and reassess as providers change |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.2b | Manage identities, credentials and access across the life cycle with phishing-resistant MFA and granular privileged access |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.2c | Protect data at every stage, type and state: decide what to protect, how much, who controls sharing, and handle termination and sanitisation |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.2d | Protect infrastructure and applications: scan everything, segment networks, harden configurations, shield applications and manage vulnerabilities with a disclosure policy |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.2e | Monitor system health and resources, and keep tested response and recovery plans that use cloud capabilities |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3a | Adopt posture management capabilities deliberately: native or third-party, independent or integrated, with multi-cloud coverage |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3b | Structure provider accounts in a hierarchy with central monitoring and separate development and test accounts |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3c | Decide where authentication happens, federate identity, minimise authentication realms and enforce least privilege with entitlement management |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3d | Redesign the perimeter around data and segmentation, and place sensors for inbound, outbound and inter-service visibility |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3e | Monitor compliance, vulnerabilities, availability, misconfigurations and service footprint across regions and providers |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3f | Secure APIs and microservices: versioning, encryption, keyed and authorised access, gateways and a service mesh with ABAC |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3g | Know, validate, synchronise and centralise logs and telemetry to meet federal logging requirements |
| cisa-cloud-security-technical-reference-architecture-v2-0::5.3h | Deploy through automation: integrated DevSecOps, golden images, zero-downtime replacement, vetted dependencies, infrastructure as code, key management and drift control |
What is CISA Cloud Security Technical Reference Architecture v2.0 and who does it apply to?
CISA Cloud Security Technical Reference Architecture v2.0 is a compliance framework from United States with 3 domains and 26 controls. CISA's cloud security reference architecture for federal agencies: FedRAMP continuous monitoring and incident communication, secure cloud migration with DevSecOps and centralised services, and cloud security posture management across governance, identity, data, infrastructure, monitoring, APIs, logging and automated deployment. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does CISA Cloud Security Technical Reference Architecture v2.0 actually require?
CISA Cloud Security Technical Reference Architecture v2.0 has 26 controls organised across 3 domains. The largest domains are Section 5: Cloud security posture management – CISA Cloud Security Technical Reference Architecture v2.0 (14 controls), Section 4: Cloud migration – CISA Cloud Security Technical Reference Architecture v2.0 (9 controls), Section 3: Shared services, service models and FedRAMP – CISA Cloud Security Technical Reference Architecture v2.0 (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of CISA Cloud Security Technical Reference Architecture v2.0 do I already cover?
CISA Cloud Security Technical Reference Architecture v2.0 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement CISA Cloud Security Technical Reference Architecture v2.0?
Start your CISA Cloud Security Technical Reference Architecture v2.0 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CISA Cloud Security Technical Reference Architecture v2.0 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 26 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required