The CSA Cloud Controls Matrix is a cybersecurity control framework for cloud computing. Version 4 has 197 control objectives in 17 domains. It also says which party in the cloud supply chain should implement each control. The CAIQ questionnaire is built from it, and the STAR registry builds on both.
What the CCM is
The CSA created the CCM to help organizations assess cloud service providers. Its controls suit dynamic cloud environments. The CSA lists domains such as Audit and Assurance, Identity and Access Management, Cryptography, Encryption and Key Management, Logging and Monitoring, and Threat and Vulnerability Management. The page we read names those as examples from the 17.
Who implements what
A useful feature is the attribution of each control to a party: the provider, the customer, or both. This is the shared responsibility view. When you review a cloud vendor, it tells you what you still have to do yourself.
CCM, CAIQ and STAR
- The CCM is the control set.
- The CAIQ is a set of yes or no questions for assessing cloud providers, built into the CCM. Version 4.1 combines the CCM and CAIQ in one release, per the CSA.
- STAR Level 1 lets a provider self-assess and submit results to the registry, with options for higher certifications or attestations.
Our posts on the CAIQ and on STAR levels cover those pieces.
Mappings
The CSA says the CCM aligns with standards including ISO, NIST and PCI DSS so organizations can meet multiple requirements in one process, and that mapping files are in the machine readable bundle. We did not read the mappings, so treat them as a starting point and verify the ones you rely on.
How to use it
- For a vendor review, ask for the CAIQ answers and read the shared responsibility column.
- For your own program, pick the domains that match your services and use them as a checklist.
- When a buyer asks for a framework you do not hold, a CCM based answer plus evidence is often a clear way to respond.
Licensing
The CSA says organizations that license the CCM or CAIQ for products or services sold to the public are called STAR Enabled Solutions, and internal use needs no license. Check current terms before publishing derived material.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a single control row links to several frameworks, the same idea as the CCM mappings.
Quick check
How many control objectives does CCM v4 have?
197, in 17 domains.
Is the CCM the same as STAR?
No. The CCM is the control set. STAR is the registry where providers publish assessments built on it.
Sources
Last reviewed: 19 October 2026.
