CDSA

  • Article

CDSA overview

The Content Delivery & Security Association (CDSA) is a worldwide forum advocating for the innovative and responsible delivery and storage of entertainment, software, and information content. CDSA provides community, collaboration, and communications services that protect entertainment media throughout the supply chain. In 2018, CDSA and the Motion Picture Association (MPA) launched the Trusted Partner Network (TPN) to help the industry improve content security, simplify assessments, and enable content owners to gauge their level of conformance to the MPA content protection best practices.

The CDSA Content Protection & Security (CPS) Standard provides guidance and requirements for securing media assets within a Content Security Management System (CSMS). The standard specifies a set of controls designed to ensure the integrity of intellectual property and the confidentiality and security of media assets at every stage of the digital media supply chain.

The CPS certification audit used to be administered directly by CDSA. It consists of over 300 distinct controls that help secure and manage physical data centers, harden services, and protect storage facilities. All controls are optimized to handle sensitive and valuable media assets. Once a system was validated by the CDSA assessor, CDSA would issue a certificate of compliance. To maintain compliance, the certified entity was required to submit the results of annual audits to CDSA.

Since launching the TPN, both the MPA and CDSA have ceased their individual security assessment programs to focus on managing and developing the TPN program and TPN annual assessments. Past audits or assessments will remain valid for the period originally indicated but will not be renewable within their individual programs. For both the MPA and CDSA, the primary focus is to provide a unified assessment program through the TPN.

Azure and CDSA

Microsoft Azure Media Services was the first hyper-scale cloud services media platform certified to comply with the CDSA CPS standard, offering powerful and highly scalable cloud-based encoding, encryption, and streaming capabilities. These features enable the creation and distribution of internal digital work products, as well as the distribution and monetization of premium digital content to a global audience using today’s most popular digital devices. The CPS certification provides a standards-based assurance that the intellectual property rights of media assets stored, managed, and distributed from within Azure are protected.

Note

Since launching the TPN, CDSA has ceased its individual security assessment program to focus on managing and developing the TPN program and TPN annual assessments together with the MPA. Past CDSA audits will remain valid for the period originally indicated but will not be renewable within the corresponding assessment program. The primary focus for both the MPA and CDSA is to provide a unified assessment program through the TPN.

Therefore, the Azure CDSA CPS certificate and audit report have not been renewed since they were last issued – they are made available for historical reasons. However, the Azure CDSA CPS implementation guidance continues to provide valuable insight into Azure capabilities aimed at protecting the intellectual property rights of media assets stored, managed, and distributed from within Azure.

The Azure CDSA CPS implementation guide is available for download from the Service Trust Portal Media and Entertainment section. It describes how Azure Media Services can help you create CDSA CPS compliant solutions securely and how you can create, protect, and operate digital media services on Azure.

Azure Media Services was the first hyper-scale cloud media platform to offer encryption on the fly for both video on demand and live-streaming broadcasts. Azure Media Services provides several security-enhanced upload channels for content, including the ExpressRoute private network connection to Azure, UDP upload via the Aspera client, and HTTPS upload over the Internet.

Audit reports and certificates

For instructions on how to access audit reports and certificates, see Audit documentation.

You can download the following documents from from the Service Trust Portal Media and Entertainment section. These documents are no longer being renewed because CDSA ceased their own individual assessment program to focus on managing and developing the TPN program and TPN assessments. The Azure Media Services CDSA certificate and audit report are made available for historical reasons.

Extra guidance documentation is available from the Service Trust Portal Media and Entertainment section:

Frequently asked questions

What is the significance of Azure Media Services CDSA certification?
Since launching the TPN, CDSA ceased its own security assessment program to focus on managing and developing a unified assessment program through the TPN together with the MPA. However, Azure Media Services was the first hyper-scale cloud services media platform certified to comply with the CDSA CPS standard while the CDSA assessment program was operational. This certification demonstrates that the intellectual property rights of media assets stored, managed, and distributed from within Azure are protected according to a well-respected industry standard.

Moreover, the Azure CDSA CPS implementation guidance provides valuable insight into Azure capabilities aimed at protecting the intellectual property rights of media assets stored, managed, and distributed from within Azure. It describes how Azure Media Services can help you create CDSA CPS compliant solutions securely and how you can create, protect, and operate digital media services on Azure.

Does my organization still need to undergo a TPN assessment?
Production facilities, visual effects houses, and other service partners should work with their executive producers and directors to understand the new security requirements, including the annual TPN assessment. You can hire a qualified TPN assessor and then manage your assessment process using the secure online platform. The TPN assessment does not provide a “pass/fail” grade, certification, or rating. It provides an assessment of a facility’s security preparedness for conformance with the MPA content security best practices. If an assessment indicates non-conformance with a security best practices control, you can validate remediation via follow-up assessment or furnish your own evidence of remediation to the TPN.

Since launching the TPN, both the MPA and CDSA have ceased their individual security assessment programs to focus on managing and developing the TPN program and TPN annual assessments. Past audits or assessments will remain valid for the period originally indicated but will not be renewable within their individual programs. For both the MPA and CDSA, the primary focus is to provide a unified assessment program through the TPN.

Resources