top of page
D10S_hero_bkgd_v1_2026.png
D02-cover-image2.png

D02

Cloud Security Architecture & Resilience

About The Standard Domain 

The Cloud Security Architecture & Resilience domain defines requirements for designing and operating secure cloud environments that protect data, applications, and services.

​

It covers secure cloud design, workload protection, cloud-native controls, governance and visibility, resilience engineering, and operational recovery to ensure confidentiality, integrity, availability, and business continuity.

Secure Cloud Design

Shared Responsibility

Workload Protection

Visibility & Governance

Resilience & Recovery

Why Adoption is Necessary

Architectural Clarity

 

Provides a structured blueprint for secure cloud architectures across services, workloads, accounts, subscriptions, projects, and environments.

Consistent Engineering Expectations

Aligns teams on proven patterns for cloud controls, workload protection, secure configuration, governance, and resilience capabilities.

Measurable Verification

​

Defines verifiable outcomes and continuous validation for cloud security controls, configuration posture, workload protection, and resilience.

Stronger Evidence 

​

Supports traceability, audit readiness, and clear design evidence for cloud security intent, implementation, control operation, and review.

How The Standard Works

Requirements

​

Define the outcomes and capabilities cloud architectures must achieve to be secure, resilient, observable, and compliant.

Technical Specifications

Provide the architecture patterns, control expectations, and design specifications needed to meet cloud security and resilience requirements.

Verification and Validation

Define how to test, verify, and validate that cloud controls, workload protections, and resilience mechanisms operate as intended.

Implementation Guidance

Offer practical guidance, examples, patterns, and best practices to implement the standard effectively across real cloud environments.

Associate Standards Preview

Associate Standards Coming in Q3 2026 

Detailed, implementation-level standards that support D01 will be published in Q3 2026 to help teams operationalize secure network architectures.

D10S_ISAU_shield_logo_v2_2026_transp.png
Built for Builders. Backed by Evidence.

D02 provides the architectural foundation for secure cloud environments, designed, engineered, and proven to protect services, workloads, data, and business continuity.

Governance by:

ISAUnited-red_trimmed.png

Training by:

Practitioner and Organizational Use

The Defensible 10 Standards (D10S) are published under a Creative Commons Attribution–NonCommercial 4.0 International License (CC BY-NC 4.0).


This license permits free use, adaptation, and internal implementation of the D10S by individual practitioners, educational institutions, and organizations for the purpose of research, training, architecture design, or internal security engineering.


Attribution to ISAUnited.org must be maintained in all uses, reproductions, or derivative works.

Commercial, Vendor, and Integration Use

The use, reproduction, or incorporation of the Defensible 10 Standards (D10S) or their content within commercial products, software, tooling, managed services, or for-profit offerings requires a separate commercial integration or redistribution license issued by the Institute of Security Architecture United (ISAUnited.org).


This includes but is not limited to:

  • Integration into commercial or subscription-based platforms or software tools

  • Use in vendor-branded frameworks or automated compliance products

  • Redistribution of modified or adapted versions for resale or commercial benefit

 

Requests for commercial licensing or integration agreements should be directed to:  info@isaunited.org

© 2026 The Defensible 10 Standards (D10S). Owned, operated, and maintained by the Institute of Security Architecture United (ISAUnited.org).

bottom of page