Cloud Security Alliance Maps Cloud Controls Matrix (CCM) to Payment Card Industry Data Security Standard (PCI DSS) v4.0

Mapping highlights areas of congruence and misalignment between CCM and PCI DSS standards, making it easier for payment processing services to mitigate risk

BELLEVUE, WA – SECtember – Sept. 19, 2023 – The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today announced the mapping of its Cloud Controls Matrix v4 (CCM) to the Payment Card Industry Data Security Standard (PCI DSS) v4.0. The mapping identifies the equivalence and gaps between the control specifications of the CCM v4 and PCI DSS v4.0 requirements. The mapping also allows for a more streamlined compliance approach and improved risk mitigation outcomes for enterprises that process or have access to payment data and that have also embraced cloud technologies. The mapping with PCI DSS v4.0 is included in the new minor update of CCM, transitioning from v4.0.8 to v4.0.9.

CSA’s Cloud Controls Matrix (CCM) serves as the leading cybersecurity control framework for cloud computing, while the Payment Card Industry Data Security Standard (PCI DSS) v4.0 provides a baseline of technical and operational requirements designed to protect payment card data. Whereas both CCM and PCI DSS share many common security goals, there are notable differences and are not interchangeable.

“Mapping CCM to PCI DSS v4.0 provides a deeper understanding of and guidance for those attempting to apply these security requirements or independently assess if controls have been achieved that best mitigate the unique risks for payment data in cloud environments,” said Troy Leach, Chief Strategy Officer, Cloud Security Alliance and former CTO and Chief Standards Architect of the PCI Security Standards Council.

The additional mapping brings the total number of mappings to 12. The CCM Working Group previously mapped CCM v4 to the following standards: AICPA TSC (2017), CCM v3.0.1, CIS v8.0, ISF SOGP 2022, ISO/IEC 27001 (2013, 2022), ISO/IEC 27002 (2013, 2022), ISO/IEC 27017 (2015), ISO/IEC 27018 (2019), NIST CSF v1.1, NIST 800-53r5, and PCI DSS v3.2.1.

“At Coalfire we understand the importance of security and compliance for managing risk. Financial organizations with multiple compliance targets benefit from additional control mappings, such as this one, which aid their efforts to protect customers and their data,” said Kerry Steele, Principal, Payments and Cloud Advisory at Coalfire.

“As organizations seek to simplify security and compliance, Schellman is proud to be a partner with the Cloud Security Alliance and Coalfire in mapping PCI DSS v4.0 to CCM v4. These endeavors improve adoption by identifying the overlap of controls across frameworks, making a smoother path for our collective clients,” said Sully Perella, Technical Director, Schellman.

The CCM is composed of 197 control objectives that are structured in 17 domains, covering all key aspects of cloud technology. It can be used as a tool for the systematic assessment of a cloud implementation and provides guidance on which security controls should be implemented by which actor within the cloud supply chain. The control framework is aligned to the CSA Security Guidance for Cloud Computing and is the de facto standard for cloud security assurance and compliance.

About Cloud Security Alliance
The Cloud Security Alliance (CSA) is the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. CSA harnesses the subject matter expertise of industry practitioners, associations, governments, and its corporate and individual members to offer cloud security-specific research, education, training, certification, events, and products. CSA's activities, knowledge, and extensive network benefit the entire community impacted by cloud — from providers and customers to governments, entrepreneurs, and the assurance industry — and provide a forum through which different parties can work together to create and maintain a trusted cloud ecosystem. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa.

Media Contacts
Kristina Rundquist
ZAG Communications for CSA
[email protected]