The Cloud Security Alliance-backed foundation announced a catastrophic risk annex, CNA authorization and two agentic AI specification acquisitions.