Cloud Controls Matrix (CCM)

The Cloud Controls Matrix (CCM) is a set of security controls for assessing and managing the risks associated with cloud computing services. Adhering to the CCM demonstrates a provider's cloud security posture, control by control, to customers and assessors; providers typically evidence it through a completed Consensus Assessment Initiative Questionnaire (CAIQ) or a listing in the Cloud Security Alliance (CSA) Security, Trust, Assurance, and Risk (STAR) registry.

Full Name

Cloud Controls Matrix

Type

Framework

Authoritative Source

CSA Cloud Controls Matrix v4

Established

2010; current version 4 (2021)

Managed By

Cloud Security Alliance (CSA)

Applies To

Cloud service providers and organizations evaluating them

Certification

Yes: CSA STAR program (Level 1 self-assessment, Level 2 third-party certification or attestation)

Purpose

CCM provides a standardized framework for evaluating a cloud provider's security posture by examining areas such as access control, data encryption, and incident response.

Assessment tool

The primary method to assess CCM compliance is a questionnaire called the Consensus Assessment Initiative Questionnaire (CAIQ), which helps organizations evaluate potential cloud vendors.

Benefits

For buyers, a vendor's completed CAIQ gives you a control-by-control view of their cloud security practices before you sign, and the answers are comparable across vendors because everyone responds to the same questions. For providers, publishing a CAIQ to the CSA STAR registry answers the bulk of inbound customer security questionnaires once, instead of one bespoke spreadsheet at a time. CCM also maps its controls to ISO 27001 and the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria, so evidence you already maintain for those audits carries over.