Cloud & Certification
CSA CCM
Cloud Controls Matrix
A cloud-specific control framework of nearly two hundred control objectives across seventeen domains, with a shared responsibility model that says which controls belong to the provider and which to the customer.
The companion CAIQ questionnaire and the public STAR registry are what make it operationally useful: for most major cloud services, the answers already exist and can be diffed rather than requested.
At a glance
- Category
- Cloud & Certification
- Jurisdiction
- Global
- Governance
- Cloud Security Alliance
- Status
- CCM v4.1: 197 control objectives in 17 domains; CAIQ and the STAR registry
- First released
- 2010
Links
Related frameworks
Other entries under Cloud & Certification.
- ISO/IEC 27017: Cloud Security Controls
- BSI C5: Cloud Computing Compliance Criteria Catalogue
- EU Cloud CoC: EU Cloud Code of Conduct
See CSA CCM in context
Open the interactive Data Landscape for Regulation to compare CSA CCM against every other framework, or grab the raw JSON. Certification schemes and editions move — follow the source links before relying on this page.