Cloud Controls Matrix (CCM)
The CSA Cloud Controls Matrix is a cloud security and privacy control framework; CCM v4.1 contains 207 controls across 17 domains and accompanies CAIQ.
Definition
The Cloud Controls Matrix (CCM) is a cloud security and privacy control framework published by the Cloud Security Alliance. The January 2026 CCM v4.1 release contains 207 controls across 17 domains and includes mappings, implementation guidance, metrics material, and an accompanying CAIQ assessment.
Context
CCM provides a control taxonomy for cloud security and shared-responsibility analysis. CAIQ questions assess those controls, while CSA's STAR program provides separate self-assessment and assurance paths. Record the CCM release and control identifier when reusing evidence or questionnaire answers.
Why it matters
Use the current CSA release package for exact control text and mappings. Copied counts and summaries can become stale as CSA revises the matrix, CAIQ, implementation guidance, and machine-readable bundles.
Map each applicable control to the actual product architecture, inherited cloud-provider responsibilities, vendor-managed safeguards, evidence owner, review date, and known exceptions. A framework mapping does not itself demonstrate operating effectiveness.
When answering a CCM- or CAIQ-based questionnaire, preserve the control identifier and version. Revalidate mapped answers when the product scope, cloud provider, architecture, control implementation, source evidence, or framework release changes.
Reviewed primary sources
The definition above distinguishes the current publishers and artifacts using these primary sources.