CSA CCM

What is CSA CCM?

The CSA CCM, or Cloud Controls Matrix, is a cybersecurity control framework for cloud computing, published by the Cloud Security Alliance (CSA). It sets out 207 controls across 17 security domains and says which party in the cloud supply chain should implement each. It applies to cloud service providers and their customers.

The current version is CCM v4.1, which CSA publishes together with the Consensus Assessment Initiative Questionnaire (CAIQ) v4.1. It succeeds CCM v4.0.13 and was released on 27 January 2026. CSA's pages announce no further revision.

The CSA CCM framework does two jobs. It is used to assess a cloud implementation systematically, and it sets out the shared responsibility model by defining the security roles of cloud service providers and customers. CSA aligns it to its Security Guidance for Cloud Computing and calls it a de-facto standard for cloud security assurance and compliance. Its official page carries the domain list and the licensing terms.

Why it matters

A prospect asks for your CAIQ. In v4.1 it has 283 yes/no questions, and the deal waits on the answers.

The CCM is the control set behind that questionnaire. Cloud providers can self-assess with the CAIQ, which is STAR Level 1, and submit the result to the CSA STAR Registry. The CAIQ is how the CCM's controls get assessed in practice.

The second reason is responsibility. A cloud deployment has a provider, a customer and often other parties in the supply chain, and each assumes the others hold the control.

Shared responsibility that nobody wrote down belongs to nobody.

There is also a date. Under CSA's transition timeline, CSA STAR accepts both v4.0 and v4.1 submissions until December 2027. From then only v4.1-based STAR Level 1 and Level 2 submissions are accepted.

Who it applies to

The CSA CCM is written for cloud service providers and the customers who rely on them. It carries guidance on which actor in the cloud supply chain should implement which control, so it is useful to a SaaS vendor answering a buyer and to a buyer assessing a supplier.

No law or regulator we found makes the CCM mandatory, and a provider chooses whether to enter CSA STAR, the assurance programme built on it. In practice the obligation is contractual: it applies when a customer, tender or procurement process asks for a CAIQ or a STAR entry.

For an ISO 27001 holder, the difference is scope. ISO 27001 certifies a management system across the organisation; the CCM is a catalogue of cloud-specific controls. The two meet at STAR Level 2, a third-party audit: STAR Certification builds on ISO 27001, and STAR Attestation builds on a SOC 2 engagement.

The UK position

The sources checked for this entry name no UK statute or regulator that requires the CCM. A UK firm meets it commercially, as a cloud provider whose customers ask for a CAIQ or a CSA STAR Registry entry during procurement.

There is one regulatory link. CSA's CCM v4.1 download includes a reverse mapping to the EU Digital Operational Resilience Act (DORA), which is relevant to UK firms serving EU financial entities. It is a mapping, not a legal requirement to use the CCM.

A UK firm that consumes cloud services and never sells them will rarely meet the CCM directly.

Key requirements

The CSA CCM matrix is a catalogue of 207 controls grouped into 17 domains:

• Audit & Assurance
• Application & Interface Security
• Business Continuity Management & Operational Resilience
• Change Control & Configuration Management
• Cryptography, Encryption & Key Management
• Datacenter Security
• Data Security & Privacy
• Governance, Risk Management & Compliance
• Human Resources Security
• Identity & Access Management
• Interoperability & Portability
• Infrastructure & Virtualization Security
• Logging & Monitoring
• Security Incident Management, E-Discovery & Cloud Forensics
• Supply Chain Management, Transparency & Accountability
• Threat & Vulnerability Management
• Universal Endpoint Management

Each control is a specification that says what must be in place, and it carries a guide to which party in the cloud supply chain holds it.

The v4.1 download includes:

1. The control matrix itself, with the shared responsibility roles of providers and customers and auditing guidelines for each control.
2. The CAIQ v4.1, the STAR Level 1 questionnaire, which is the copy a provider submits to the STAR Registry.
3. Implementation guidelines and an introductory guide to the CCM.
4. Metrics: a Continuous Auditing Metrics Catalog and a code of practice for key metrics.
5. Mappings to other standards, including NIST 800-171 rev.2, MITRE ATT&CK v17.1 and a DORA reverse mapping.

A completed questionnaire is a claim. The controls behind it are the evidence.

Frequently asked questions