Download Publication
Cloud Controls Matrix and CAIQ v4
Release Date: 06/03/2024
Working Group: Cloud Controls Matrix
The Cloud Controls Matrix (CCM) is a cybersecurity control framework that maps to industry best practices and is considered the standard for cloud security and privacy. The accompanying CAIQ provides a set of “yes/no” questions to assess security controls. Download both the CCM and CAIQ here.
What’s included in this download:
- Guide to the CCM and CAIQ: This guide explains the individual components in this download file, their purpose, and how to use them.
- CCM + CAIQ v4: The latest version of the Cloud Controls Matrix and the Consensus Assessment Initiative Questionnaire.
- Mappings: Detailed mappings to various industry standards.
- CCM v4 Implementation Guidelines: Best practices for implementing the CCM.
- CCM v4 Auditing Guidelines: Steps and guidance for auditing against the CCM.
- Continuous Auditing Metrics: Catalog of security metrics for the cloud.
- STAR Level 1 Security Questionnaire (CAIQ v4): Use this to submit to the STAR Registry.
About the CAIQ versions in this file:
- CCM + CAIQ v4: This version is for reference only and cannot be submitted to the STAR Registry.
- STAR Level 1 Security Questionnaire (CAIQ v4): Submit this version to the STAR Registry.
Related Resources
- Valid-AI-ted (AI-Powered Validation of CAIQ v4 Submissions): An optional service that uses AI to validate STAR Level 1 Security Questionnaire (CAIQ v4) submissions. Includes automated scoring, feedback, and a Valid-AI-ted badge for passing organizations.
- CCM Machine Readable (JSON/YAML/OSCAL): A machine-readable format of the CCM Controls, CAIQ Security Questionnaire, Implementation Guidelines (both JSON/YAML and OSCAL) and Mappings (JSON/YAML) to support organizations that would like to foster CCM automation.
Download this Resource
Share
Related resources
Related Resources
.jpeg)
.jpeg)
.jpeg)
.jpeg)
Interested in helping develop research with CSA?
Related Certificates & Training
.png){kind=logo}
Learn the core concepts, best practices and recommendation for securing an organization on the cloud regardless of the provider or platform. Covering all 14 domains from the CSA Security Guidance v4, recommendations from ENISA, and the Cloud Controls Matrix, you will come away understanding how to leverage information from CSA's vendor-neutral research to keep data secure on the cloud.
Learn more
Learn more