Cloud Controls Matrix (CCM) framework
Cloud Controls Matrix (CCM) framework
The CCM is CSA's cloud-specific control framework. The exam tests its structure, control specifications, domain organization, versioning, and how it is used as audit criteria in STAR Level 2.
Core rules
- CCM v4 is the current major version. It organizes controls into 17 domains (e.g., Audit & Assurance, Application & Interface Security, Business Continuity, Change Control, Data Security, Identity & Access Management, Interoperability & Portability, Mobile Security, Supply Chain Management, Threat & Vulnerability Management).
- Each control has a unique ID (e.g., A&A-01), a control specification (the required outcome), and architectural relevance notes for IaaS, PaaS, and SaaS.
- CCM is a control framework, not a questionnaire. It defines what should be done; the CAIQ asks how it is done.
- Controls are mapped to other standards (ISO/IEC 27001, NIST SP 800-53, PCI DSS) to reduce duplication.
- In STAR Level 2, the auditor uses CCM as the criteria. For ISO/SOC2 routes, the auditor performs a gap assessment against CCM; for C-STAR, the audit is directly against CCM.
Worked example
An auditor is assessing a provider's data classification. The CCM control DS-01 (Data Classification) requires the provider to classify data by sensitivity and apply handling requirements. The provider has an ISO 27001 certificate covering A.8.2.1, but the auditor must verify the CCM specification, including cloud-specific handling. The auditor samples data sets, reviews labeling, and interviews staff. If the provider meets DS-01, the control is satisfied; if not, the auditor records a gap. Reasoning: CCM controls are outcome-based; ISO coverage does not automatically satisfy CCM.
Traps
- Confusing CCM with CAIQ. CCM is the control set; CAIQ is the questionnaire.
- Assuming CCM is only for IaaS. It covers IaaS, PaaS, and SaaS with architectural relevance.
- Using an outdated CCM version; v4 is current and has different domain names from v3.
- Thinking CCM certification exists independently. CCM is used within STAR audits; there is no separate CCM certificate.