Cloud Controls Matrix and CAIQ v4
Release Date: 06/07/2021
Working Group: Cloud Controls Matrix Working Group
What’s included in this download:
- CCM v4
- CAIQ v4
- STAR Level 1: Security Questionnaire (CAIQ v4)
- Implementation Guidelines
- Auditing Guidelines (coming soon)
- CCM Metrics
- CCM + CAIQ v4: This version cannot be used to submit to STAR and is just for reference.
- STAR Level 1: Security Questionnaire (CAIQ v4): Used to submit to the STAR Registry and includes all the necessary features. This version can also be downloaded on it’s own here.
- Mappings to the following: ISO/IEC 27001/27002/27017/27018, CCM V3.0.1, AICPA TSC (2017) and CIS Controls V8. These mappings identify the equivalence, gaps and misalignment between the control specifications of the CCM V4 and other standards. Additional mappings for PCI-DSS and NIST 8-53 Rev.5 are under development and other new mappings will also be added in the future.
- Controls Applicability Matrix: This matrix acts as a guide to help organizations determine the shared responsibilities between the CSPs and CSCs when implementing a CCM control. For each control it also identifies which cloud architectural and organizational stack and cloud service models are applicable.
- CCM Metrics: This is the first catalog of security metrics for the cloud. These metrics aim to support internal CSP governance, risk, and compliance (GRC) activities and provide a helpful baseline for service-level agreement transparency.
CSA is a community driven organization. We would like to send you updates about our ongoing initiatives and opportunities to participate.
Provide feedback on this form
Jon-Michael C. Brook, Principal at Guide Holdings, LLC, has 20 years of experience in Information Security with such organizations as Raytheon, Northrop Grumman, Booz Allen Hamilton, Optiv Security and Symantec. Mr. Brook's work traverses the government, financial, healthcare, gaming, oil and gas and pharmaceutical industries. Mr. Brook obtained a number of industry certifications, including CISSP and CCSK, has patents and trade secrets in...
Sean Cordero brings more than 15 years of information security and IT experience to his current role as director, information security at Optiv. Cordero provides executive level advisement for the company’s Fortune 50 clients. Cordero’s prior leadership roles included: President of Cloud Watchmen, CSO for EdFund, CSO for ECMC West, Director of Security and Compliance for Charlotte Russe.
Cordero is a thought-leader and serves as chair...
Risk, Audit, Control and Compliance Professional
Michael Roza is a risk, audit, control and compliance professional with 20-plus years of experience with organizations such as Bridgestone EMEA, Komatsu International, Mitsui Novus International, Johnson and Johnson Inc., and Baxter, Inc. Within CSA, he has served as lead author/contributor for 11 projects completed by CSA’s Internet of Things, Blockchain/Distributed Ledger, Top Threats, Cloud Control Matrix, and Software-Defined P...
Chief Technology Officer, CSA
Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...
Aradhna Chetal is a Senior Director Executive - Cloud Security at TIAA. She has worked for a number of enterprises like JP Morgan Chase, HSBC, Merck, Boeing Company, T-Mobile and Microsoft where she was responsible for defining cloud security strategies, cloud security architecture, digital transformation and migration of applications to the cloud.
Aradhna is a Cloud Security Alliance Research Fellow and has been a key contributor...
Executive Director, Data Management & Protection
Paul Rich is the executive director, data management and protection for JPMorgan Chase & Co., where he leads the strategy and implementation within the company for unstructured data protection both in the cloud and on-premises. He is the co-chair of the CSA Cloud Key Management Working Group, which he envisions as a means of hearing diverse perspectives on the use of cloud services and expectations for both data privacy and secu...
Head of Industry Standards Engagement for AWS
Sean Estrada is Head of Industry Standards Engagement for AWS, where he is responsible for driving engagement with industry standards organizations and alliances. Building on over 15 years of experience in information security, audit and compliance, Sean is Amazon's internal subject matter expert on security standards design, strategy and implementation, and is Amazon's representative to the PCI Board of Advisors and the Vice President of t...
Director of Information Security
With more than 25 years of information security experience, Shawn Harris is currently the Director of Information Security at Starbucks Coffee Company. His background includes engineering, architecture, and executive responsibilities. Shawn is currently co-chair of the CSA Cloud Controls Matrix working group, where he led efforts to develop the Cloud Control Matrix 4.0. Additionally, he has served on CSA’s Consensus Assessments ...
Manager, PwC Cybersecurity
Harry Lu brings perspectives of Cloud Security from the professional services industry. He is currently a manager with the PwC Cybersecurity practice. Being part of the PwC Cloud Security Team, Harry’s background includes security strategy planning, security operations development and security executive consulting roles. He has also had years of hands-on experience implementing cloud security technologies across SaaS, IaaS and hybrid cloud ...
Chief Security Engineer and Executive Consultant, Emagined Security Inc.
Jens Laundrup, Chief Security Engineer and Executive Consultant, Emagined Security Inc., has spent over 30 years in the Information Security space to include numerous security engineering disciplines including Military, Government and Corporate Information Security, Compliance Program Design, Architecture Design, and Network & Physical Security. Mr. Laundrup has led the development and design of cutting-edge risk-based security programs and...