CSA STAR Level 1 and 2 Cloud Controls Matrix CCM | CSA STAR Level 1 and 2

The Cloud Controls Matrix (CCM)

The Cloud Controls Matrix (CCM) is a robust framework of cloud-centric security controls, precisely designed to evaluate cloud service provider security.

Comprehensive Control Set
It includes a vast array of security controls, addressing various domains crucial for cloud environments. This ensures a holistic assessment, leaving no significant security stone unturned.
Cloud-Specific Focus
Risk Assessment Tool
Standardized Evaluation
Foundation for Assurance

CCM: Levels of Assurance

Level 1: Self-Attestation

Providers internally assess their security against the CCM.

Level 1: CAIQ Upload

The completed CCM-based questionnaire is publicly shared.

Level 2: Independent Audit

Third parties meticulously audit CCM compliance.

Level 2: Report Publication

Audit findings are formally released on the STAR Registry.

CCM Level 2: Critical Control Domains

The CCM emphasizes specific controls for Level 2 certification, crucial for robust, independently verifiable cloud security.

Access Control

This rigorously audited domain ensures only authorized entities access cloud resources, enforcing least privilege principles.

Incident Response

Focuses on processes for promptly detecting, containing, and recovering from security incidents.

Encryption Implementation

Mandates the effective use of cryptography for data protection, both at rest and in transit.

Vulnerability Management

Requires systematic identification and timely remediation of security flaws to enhance overall security.

Continue Reading

Ready to learn more about Process Flow & Timeline?

Cloud Controls Matrix (CCM)

Speak to a GRC expert

Share on social media

The Cloud Controls Matrix (CCM)