CCM v4.1 to ISO27001+27017+27018 Mapping
Open Until: 12/04/2026
.png)
This project maps all 207 controls of the Cloud Controls Matrix v4.1 against ISO/IEC 27001:2022, ISO/IEC 27017 and ISO/IEC 27018. It builds on CSA's earlier CCM v4.0 to ISO/IEC 27001 mapping, which provided the starting baseline and includes the addition of ISO/IEC 27017 and 27018 to scope. Each control is assigned a gap level — No Gap, Partial Gap or Full Gap — and, where a gap exists, an addendum stating what the ISO standards do not require and what would be needed to close the difference. Mapped content is limited to auditable requirements: ISO/IEC 27001 clauses 4 to 10 and Annex A, ISO/IEC 27017's CLD controls and ISO/IEC 27018's Annex A, excluding implementation guidance against which conformity cannot be assessed. The deliverable gives cloud service providers and customers already certified to ISO/IEC 27001 a clear view of what additional work CCM v4.1 conformance requires, supports organisations pursuing CSA STAR certification alongside ISO certification, and provides a documented, reproducible basis for the differences between the two frameworks.
Key Takeaways
- Full coverage of a major certification pairing. All 207 CCM v4.1 controls assessed against ISO/IEC 27001:2022, ISO/IEC 27017 and ISO/IEC 27018, the first CSA mapping to cover the three standards together rather than ISO/IEC 27001 alone.
- Actionable for certified organisations. For each control, the deliverable states what an ISO-certified organisation has already done toward CCM v4.1 conformance and precisely what remains, supporting CSA STAR certification alongside ISO certification, and reducing duplicated assurance effort.
- A documented basis for standards engagement. Each gap is recorded as a specific, citable delta against named ISO clauses, giving CSA an evidence base on where the standards could be strengthened for cloud.
