The cybersecurity community offers a variety of reference documents to help organisations come to a common understanding of the cloud and cloud security issues. The Cloud Reference Architecture, published by the National Institute for Standards and Technology ([[National Institute of Standards and Technology|NIST]]) in their SP 500-292, offers a high-level taxonomy for cloud services. Below is a high-level view of NIST's vision for how the elements of the architecture fit together. ![[NIST Cloud Architecture.png]] The Cloud Security Alliance (**CSA**) is an industry organization focused on developing and promoting best practices in cloud security. They developed the Cloud Controls Matrix (CCM) as a reference document designed to help organisations understand the appropriate use of cloud security controls and map those controls to various regulatory standards. The CCM is a lengthy Excel spreadsheet, available for download from [here](http://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v3-0-1).