What is the Cloud Controls Matrix (CCM)?

What is the Cloud Controls Matrix?

The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing. It is a spreadsheet that lists 16 domains covering all key aspects of cloud technology. Each domain is broken up into 133 control objectives. It can be used as a tool to systematically assess cloud implementation, by providing guidance on which security controls should be implemented by which actor within the cloud supply chain.The controls framework is aligned to the Security Guidance v4 and is currently considered a de-facto standard for cloud security assurance and compliance. The translated versions of CCM v3 are available here.

Map to Standards, Regulations and Controls Frameworks

The controls in the CCM are mapped against industry-accepted security standards, regulations, and control frameworks.

The CCM v4 is currently mapped to the following:

• ISO/IEC 27001/27002/27017/27018
• CCM V3.0.1
• CIS Controls V8.
• Additional mappings for AICPA TSC, PCI-DSS and NIST 8-53 Rev.5 are under development and other new mappings will also be added in the future.

The previous version of the CCM v3.0.1 is mapped to the following standards:

• ISO 27001/27002/27017/27018
• NIST SP 800-53
• AICPA TSC
• German BSI C5
• PCI DSS
• ISACA COBIT
• NERC CIP
• FedRamp
• CIS
• And many others...

How does it work?

The Cloud Controls Matrix is a baseline control framework specifically designed for managing risk in the cloud. Organizations (CSPs and CSCs) can use the CCM to build a detailed list of requirements and controls that they want to implement in order to mitigate risk for a given cloud service that falls within the security and compliance assessment scope.

Each CCM control and underlying requirements map onto multiple industry-accepted security standards and regulations, thus allowing organizations to better understand and track along what are similar, equivalent, or additional requirements found in those frameworks. It reduces the need to use multiple frameworks and simplifies cloud security, risk management, and compliance by bringing greater efficiency, effectiveness, and transparency towards the broader landscape of cloud security and certification.

In this context, CSA and the CCM Working Group perform mappings and gap analysis exercises between CCM and widely-used standards, giving organizations the opportunity to assess their cloud services security posture through the lens of the CCM in comparison to other standards.

Furthermore, the CCM provides a control’s applicability and responsibility matrix. The matrix indicates the cloud service model type (IaaS, PaaS, SaaS) each CCM control applies to, and acts as a guide to help organizations determine which of the two cloud parties (CSP or CSC) is responsible for the implementation of the control. It also identifies which cloud architectural and organizational stack and cloud service models are applicable.

For Cloud Customers

Use the CCM to assess cloud vendors or in place of an RFP

The Consensus Assessments Initiative Questionnaire (CAIQ) is a companion to the CCM that provides a set of “yes or no” questions a cloud consumer or auditor may wish to ask a cloud provider. Based on the security controls in the CCM, the questions can be used to document which security controls exist in a provider’s IaaS, PaaS, and SaaS offerings. Organizations often use the CAIQ to get additional protection by building a request for proposal (RFP) with the information from CAIQ. Organizations can then verify the validity of a vendor’s answers during the RFP interview. Over 500 organizations currently use the CAIQ to submit self-assessments on the STAR registry.

For Cloud Solution Providers (CSPs)

Use the CCM to submit to CSA’s public registry.

The CCM is used as the standard to assess the security posture of organizations on the Security, Trust, Assurance and Risk (STAR) registry. The STAR program promotes flexible, incremental and multi-layered certifications that integrate with popular third-party assessments to avoid duplication of effort and cost. Security providers can fill out the extended question set that aligns with the CCM and send it to potential and current clients to demonstrate compliance to industry standards, frameworks and regulations. It is recommended that providers submit the completed CAIQ to the STAR Registry so it is publicly available to all clients.

Security Domains Covered by the CCM

CSA is currently working on releasing the fourth iteration of the Cloud Controls Matrix. The CCM v.4 constitutes a significant upgrade to the previous version (v3.0.1) by introducing changes in structure of the framework with a new domain dedicated to Log and Monitoring (LOG), and modifications in the existing ones (GRC, A&A, UEM, CEK). This update will also deliver a significant increase of requirements as a result of developing additional controls and updating existing ones.

Additional features of the CCM v.4 update are:

• Ensured coverage of requirements deriving from new cloud technologies
• New controls and security responsibility matrix
• Improved auditability of the controls, and enhanced interoperability and compatibility with other standards.

The domains covered in the Cloud Controls Matrix (CCM) v4 are:

1. Application & Interface Security
2. Audit and Assurance
3. Business Continuity Mgmt & Op Resilience
4. Change Control & Configuration Management
5. Data Security & Privacy Lifecycle Management
6. Datacenter Security
7. Cryptography, Encryption and Key Management
8. Governance, Risk Management and Compliance
9. Human Resources Security
10. Identity & Access Management
11. Security Infrastructure & Virtualization
12. Interoperability & Portability
13. Universal EndPoint Management
14. Security Incident Management, E-Discovery & Cloud Forensics
15. Supply Chain Management, Transparency & Accountability
16. Threat & Vulnerability Management
17. Logging and Monitoring

What if there is a regulation or industry framework not covered in the current version of CCM?

In the case where there is a region-specific regulation or new framework that organizations need to map to, CSA will release a CCM mapping. You can find a list of all available mappings to the Cloud Controls Matrix (CCM) here.

Most Recent CCM Mappings:

• Gap Analysis Report - Mapping of the Association of Banks in Singapore Cloud Computing Implementation Guide 2.0 to Cloud Security Alliance Cloud Controls Matrix v3.0.1
• Enterprise Architecture to CCM Shared Responsibility Model
• CSA CCM v3.0.1 Addendum - Cloud OS Security Specifications
• Mapping of 'The Guidelines' Security Recommendations to CCM
• CCM v3.0.1 Addendum - FedRAMP Moderate
• CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate
• CSA CCM v3.0.1 Addendum - AICPA TSC 2017

Can I get certified against the CCM? How do I become CCM certified?

Organizations looking to get certified against the CCM can obtain an Attestation or Certification through the CSA STAR Registry.

Help CSA develop future versions of the CCM by joining the working group!

We are always looking for new experts to join the Cloud Controls Matrix Working Group to help make the CCM the most effective tool it can be for people actually using it in the industry. You can learn more and join the working group here.