CSA Cloud Controls Matrix (CCM) v4

Why does it matter?

Cloud security splits responsibility between the provider and the customer, and general control catalogs rarely say which party owns which control. The CCM states who should implement each of its 207 controls, so due diligence, audits and STAR submissions start from one control set instead of a new questionnaire each time.

Key benefits include:

• Shared responsibility is explicit

The CCM defines the security roles of cloud service providers and customers for each control, so ownership is settled before an assessment starts.

• A questionnaire built into the framework

The CAIQ restates the controls as yes/no questions. CAIQ v4.1 has 283 of them, and a provider can answer once instead of repeating evaluations for each customer.

• Mappings reduce duplicate work

By May 2024 CSA had mapped the CCM to 15 references, including NIST SP 800-53 Rev. 5, NIST CSF 1.1 and 2.0, PCI DSS v3.2.1 and v4.0, ISO/IEC 27001, 27002, 27017 and 27018, AICPA TSC 2017 and CIS v8.0.

• A route to external assurance

STAR Level 1 publishes a self-assessment in the STAR Registry. Level 2 adds a third-party audit: STAR Attestation for SOC 2 or STAR Certification for ISO/IEC 27001, each built on the CCM.

• Free for internal use

No license is needed to use the CCM internally. A license is required to customize it, use it commercially or use it in consulting projects.

How does it work?

The CCM has 17 domains. Each control ID is a domain code and a number: A&A Audit and Assurance; AIS Application and Interface Security; BCR Business Continuity Management and Operational Resilience; CCC Change Control and Configuration Management; CEK Cryptography, Encryption and Key Management; DCS Datacenter Security; DSP Data Security and Privacy; GRC Governance, Risk Management and Compliance; HRS Human Resources Security; IAM Identity and Access Management; IPY Interoperability and Portability; IVS Infrastructure and Virtualization Security; LOG Logging and Monitoring; SEF Security Incident Management, E-Discovery and Cloud Forensics; STA Supply Chain Management, Transparency and Accountability; TVM Threat and Vulnerability Management; UEM Universal Endpoint Management.

Version 3.0.1 had 133 controls. Version 4.0 raised the count to 197, with 64 new controls, and added the Logging and Monitoring domain. Version 4.1, which succeeds v4.0.13, adds 11 new control specifications in Datacenter Security, Logging and Monitoring, Security Incident Management, Supply Chain Management and Threat and Vulnerability Management, removes one Identity and Access Management control, and revises many others, for 207 in total. Examples of the new controls are audit log sanitization, Service Bill of Materials transparency and threat modeling.

CSA's transition timeline lets providers submit on either version from March 2026. After December 2027 all new STAR submissions use v4.1 and Level 1 submissions need CAIQ v4.1, and CCM v4.0.x and CAIQ v4.0.x are withdrawn in January 2028. Providers already in the registry get a two-year transition period. The v4.1 bundle adds mappings to NIST SP 800-171 Rev. 2 and MITRE ATT&CK v17.1, plus a DORA reverse mapping; CSA says other mappings were still being updated to v4.1 in February 2026.

Key Elements

• Seventeen domains and 207 controls

The control objectives group into the 17 domains above. Each control ID is a domain code plus a number, and the framework is aligned to CSA's Security Guidance for Cloud Computing.

• Shared Security Responsibility Model

Introductory guidance in the v4.1 bundle covers how to use the CCM and the Shared Security Responsibility Model, which settles whether the provider, the customer or both implement a control.

• Consensus Assessments Initiative Questionnaire

The CAIQ v4.1 bundled with the CCM is a reference copy that cannot be submitted to the STAR Registry. The separate STAR Level 1 CAIQ v4.1 is the one providers submit, and CCM Lite and CAIQ Lite are streamlined versions.

• Implementation and Auditing Guidelines

The Implementation Guidelines describe what the provider should do for each control, and sometimes the customer. The Auditing Guidelines give auditors a baseline for assessing CCM audit areas and extend chapter 7 of the CCAK guide.

• Published mappings

CSA maps the CCM to standards and regulations so evidence can be reused. The mappings name specific editions, such as PCI DSS v4.0 and CIS v8.0, and CSA has said additional mappings are under development.

• Metrics and machine-readable formats

v4.1 adds a Code of Practice for Implementing and Maintaining Key Metrics and a Continuous Auditing Metrics Catalog. A separate bundle provides controls, CAIQ, guidelines and mappings in JSON and YAML, with the guidelines also in OSCAL.

What does it cover?

The CCM applies to any organization that provides or consumes cloud services. Providers use it to document and assure their controls, customers use it to assess providers and define their own responsibilities, and auditors use it for STAR Level 2 work. It covers all key aspects of cloud technology and is not tied to one industry.

What are its objectives?

The Cloud Controls Matrix gives the cloud supply chain one assessable definition of good security practice.

Provide a catalog of cloud security control objectives grouped into 17 domains.

Make clear which actor in the cloud supply chain should implement each control.

Support self-assessment and third-party assessment through the CAIQ and the CSA STAR program.

Reduce duplicate compliance effort through maintained mappings to other standards.

Support continuous assurance with auditing guidelines, a metrics catalog and machine-readable formats.

Stay current through versioned releases, such as the January 2026 update to v4.1.

Framework in Context

The CCM is CSA's flagship framework and the control basis for STAR, whose Level 2 builds on ISO/IEC 27001 and SOC 2. It sits beside ISO/IEC 27001 and ISO/IEC 27017 in a cloud provider's program as the cloud-specific layer, and CSA's mappings let a provider show how one control satisfies several references. CSA also issues other matrices, such as the IoT Controls Matrix and the AI Controls Matrix, which are separate documents with their own controls.

Common Framework Mappings

CSA publishes and maintains mappings between the CCM and the references below. They name specific editions, including PCI DSS v4.0 and CIS Controls v8.0 rather than the later PCI DSS 4.0.1 and CIS Controls v8.1, so check the edition before reusing evidence.

Mapped frameworks include:

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

NIST 800-53 Rev.5

NIST CSF 2.0

PCI DSS 4.0.1

SOC 2 (AICPA TSC 2017)

CIS Controls v8.1

ISF Standard of Good Practice for Information Security 2022

CSA STAR