Download Publication
Who it's for:
- Chief Information Security Officers
- Cloud Security Architects & Engineers
- Governance, Risk, and Compliance Professionals
- Internal and External Auditors
- Cloud Platform Owners & Security Leads
Cloud Controls Matrix and CAIQ v4.1
Release Date: 01/27/2026
The Cloud Controls Matrix (CCM) is a cybersecurity control framework made up of 207 controls across 17 security domains. The CCM maps to industry best practices and is considered the standard for cloud security and privacy. The accompanying Consensus Assessment Initiative Questionnaire (CAIQ) provides a set of “yes/no” questions to assess security controls.
What’s included in this download:
- Guide to the CCM and CAIQ: An explanation of the individual components in the download file, their purpose, and how to use them.
- CCM v4.1: The latest version of the Cloud Controls Matrix, including detailed mappings to other industry standards, auditing guidelines, and a reference version of the CAIQ. Note that this version of the CAIQ cannot be submitted to the STAR Registry.
- CAIQ v4.1 (STAR Level 1 Security Questionnaire): The version of the CAIQ that can be submitted to the STAR Registry.
- Code of Practice for Implementing and Maintaining Key Metrics: Principles for effectively measuring progress.
- Continuous Auditing Metrics Catalog: Detailed explanations of security metrics for the cloud.
- CCM v4.1 Implementation Guidelines: Best practices for implementing the CCM controls.
Related resources:
- Valid-AI-ted: An optional service that uses AI to validate CAIQ submissions. Includes automated scoring, feedback, and a Valid-AI-ted badge for passing organizations.
- CCM Machine Readable Bundle (JSON/YAML/OSCAL): A machine-readable format of the CCM Controls, CAIQ, Implementation Guidelines (JSON/YAML and OSCAL), and Mappings (JSON/YAML) to support organizations that would like to foster CCM automation.
Download this Resource
Prefer to access this resource without
an account?
Download the publication. Download the presentation.
Share
Related resources
Related Resources
Interested in helping develop research with CSA?
Related Certificates & Training
.png){kind=logo}
Learn the core concepts, best practices and recommendation for securing an organization on the cloud regardless of the provider or platform. Covering all 14 domains from the CSA Security Guidance v4, recommendations from ENISA, and the Cloud Controls Matrix, you will come away understanding how to leverage information from CSA's vendor-neutral research to keep data secure on the cloud.
Learn more
Learn more