CSA Cloud Controls Matrix

What is the Cloud Controls Matrix?

The Cloud Controls Matrix (CCM) is a catalogue of security controls written specifically for cloud computing. It is published by the Cloud Security Alliance (CSA), a nonprofit, and the current version is v4.1. It contains 197 control objectives in 17 domains, from application and interface security, through identity and access management and logging, to supply chain management and threat and vulnerability management.

Its distinctive feature is that every control says who is responsible: the cloud provider, the customer, or both. That makes it a practical tool for working out the shared responsibility between a cloud service and the organisations that use it.

What comes with it?

• The CAIQ (Consensus Assessments Initiative Questionnaire): a set of yes-or-no questions, one group per control, that providers answer to describe what they do. From v4.1 the CAIQ is combined with the matrix in a single package.
• Mappings: machine-readable mappings from each control to other standards, such as ISO/IEC 27001 and NIST publications, so work done once can be reused.
• Implementation and auditing guidelines, explaining what each control means in practice and how to assess it.

The matrix is free to download and use inside your organisation. Customising it, using it commercially or using it in consulting work needs a licence from CSA.

What is STAR?

CSA’s Security, Trust, Assurance and Risk (STAR) programme puts the matrix to work as public assurance. Providers list themselves on the free STAR Registry:

• STAR Level 1 is a self-assessment: the provider publishes its completed CAIQ.
• STAR Level 2 adds an independent third-party audit, either a certification built on top of ISO/IEC 27001 or an attestation built on top of a SOC 2 report, each extended to cover the CCM.

Customers can look a provider up on the registry before sending a questionnaire of their own.

Who uses it?

• Cloud providers, to answer customers’ security questions once and publicly, and to plan their control set.
• Cloud customers, to assess providers and to check which controls they still have to run themselves.
• Auditors, as the cloud-specific layer on an ISO/IEC 27001 or SOC 2 engagement.

Where does it fit?

The CCM doesn’t replace a management system. It sits alongside ISO/IEC 27001, which provides the management system, and cloud-specific guidance such as ISO/IEC 27017 for security and ISO/IEC 27018 for personal data in public clouds. For US government work, FedRAMP has its own requirements, though the CCM’s mappings help with the overlap. CSA has also published an AI Controls Matrix on the same model for AI systems.