Cloud Controls Matrix Working Group

Latest ResearchJoin Group
Cloud Controls Matrix and CAIQ v4
Cloud Controls Matrix and CAIQ v4

Download

Join the CCM working group
Cloud Controls Matrix Working Group
Maintaining cloud governance, risk and compliance is becoming increasingly difficult.
The more complex systems become, the less secure they become, even though security technologies improve. With the proliferation of security certifications, industry standards and regulations it is becoming increasingly challenging to keep up with the requirements to stay secure and compliant in the cloud. 

Why was the CCM created?
To respond to simplify the process of assessing the overall security risk of a cloud provider, CSA created the Cloud Control Matrix (CCM) and Consensus Assessment Initiative Questionnaire (CAIQ). The CCM provides a controls framework that gives detailed understanding of security concepts and principles that are aligned to the best practices outlined in the CSA Security Guidance for Cloud Computing. The CAIQ provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the CCM. To learn more about how to use the CCM you can download the CCM Implementation Guidelines.

Help Integrate the CCM with CRI’s Financial Services Cybersecurity Profile
CSA is partnering with the Cyber Risk Institute (CRI) to provide the financial community with new resources to map and integrate CSA’s Cloud Controls Matrix (CCM) and CRI’s Financial Services Cybersecurity Profile. The goal is to define the scope, objectives and technical specifications of the Cloud Security Framework for Financial Services. To learn more, download our group charter






Cloud Controls MatrixEnterprise ArchitectureCAIQCCAKSecurity Guidance

Along with releasing updated versions of the CCM and CAIQ, this working group provides addendums, control mappings and gap analysis between the CCM and other research releases, industry standards, and regulations to keep it continually up to date.

Next Meeting

Sep 29, 2021, 08:00AM PDT
Join the Meeting



Working Group Leadership

Sean Cordero Headshot
Sean Cordero
Sean Cordero

Sean Cordero brings more than 15 years of information security and IT experience to his current role as director, information security at Optiv. Cordero provides executive level advisement for the company’s Fortune 50 clients. Cordero’s prior leadership roles included: President of Cloud Watchmen, CSO for EdFund, CSO for ECMC West, Director of Security and Compliance for Charlotte Russe.

Cordero is a thought-leader and serves as chair...

Read more

Shawn Harris Headshot
Shawn Harris
Shawn Harris

Director of Information Security

With more than 25 years of information security experience, Shawn Harris is currently the Director of Information Security at Starbucks Coffee Company. His background includes engineering, architecture, and executive responsibilities. Shawn is currently co-chair of the CSA Cloud Controls Matrix working group, where he led efforts to develop the Cloud Control Matrix 4.0. Additionally, he has served on CSA’s Consensus Assessments ...

Read more

Harry Lu Headshot
Harry Lu
Harry Lu

Manager, PwC Cybersecurity

Harry Lu brings perspectives of Cloud Security from the professional services industry. He is currently a manager with the PwC Cybersecurity practice. Being part of the PwC Cloud Security Team, Harry’s background includes security strategy planning, security operations development and security executive consulting roles. He has also had years of hands-on experience implementing cloud security technologies across SaaS, IaaS and hybrid cloud ...

Read more

Sean Estrada Headshot
Sean Estrada
Sean Estrada

Head of Industry Standards Engagement for AWS

Sean Estrada is Head of Industry Standards Engagement for AWS, where he is responsible for driving engagement with industry standards organizations and alliances. Building on over 15 years of experience in information security, audit and compliance, Sean is Amazon's internal subject matter expert on security standards design, strategy and implementation, and is Amazon's representative to the PCI Board of Advisors and the Vice President of t...

Read more

Daniele Catteddu Headshot
Daniele Catteddu
Daniele Catteddu

Chief Technology Officer, CSA

Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...

Read more

Eleftherios Skoutaris Headshot
Eleftherios Skoutaris
Eleftherios Skoutaris

Innovation Analyst, CSA EMEA

This person does not have a biography listed with CSA.

Join the CCM working group

Cloud Controls Matrix v4 and CAIQ v4

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

Cloud Controls Matrix v4  and CAIQ v4

Cloud Controls Matrix v4 and CAIQ v4

The Cloud Controls Matrix (CCM) is a cybersecurity control framework and is considered the de-facto standard for cloud security and privacy. Version 4 of the Cloud Controls Matrix (CCM) has been combined with the Consensus Assessment Initiative Questionnaire (CAIQ). Version 4 introduces changes in the structure of the framework with a new domain dedicated to Log and Monitoring (LOG), and a significant increase in requirements. Additional features are: ensured coverage of requirements deriving from new cloud technologies, new controls and security responsibility matrix, improved auditability of the controls, and enhanced interoperability and compatibility.

CCM Translation in 10 Languages

CCM Translation in 10 Languages

CSA in the context of an agreement with OneTrust has translated the Cloud Control Matrix (CCM) v3.0.1 in 10 languages in order to facilitate their easier adoption by organizations in the corresponding countries. Provided translations are in: Spanish (ES), German (DE), French (FR), Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO) and Swedish (SV).

CCM v4 Implementation Guidelines

CCM v4 Implementation Guidelines

This document will help you understand how to navigate through the Cloud Controls Matrix v4 to use it effectively and how to interpret and implement the CCM control specifications. Given a certain CCM control specification, the document will help explain what should be done to effectively implement and monitor the control, which specific best practices should be followed, what the specific regulations of reference are, and what the differences are when implementing a control from the SaaS-PaaS-IaaS perspective.

Cloud Security Initiative for the Financial Sector Working Group

CSA is partnering with the Cyber Risk Institute (CRI) to provide the financial community with new resources to map and integrate CSA’s Cloud Controls Matrix (CCM) and CRI’s Financial Services Cybersecurity Profile. The goal is to define the scope, objectives and technical specifications of the Cloud Security Framework for Financial Services. To learn more, download our group charter


Blog Posts

The Adoption of Multi-Cloud Drives the Need for Better Data Protection and Management of Encryption Keys and Policy Controls
What is CAIQ?
CCM Testimonial: The Advantages and Future of the Cloud Controls Matrix