The W3C has undertaken standardization of CSP and you can find the W3C spec here.
Old Document Alert: The old Mozilla-specific spec document has been separated into two smaller documents, and those are deprecated in favor of the W3C spec. But in case you want them, here they are.
- Normative: Security/CSP/Specification
- Non-Normative: Security/CSP/Design Considerations