Cloud Controls Matrix

What it is

In the Cloud Security Alliance's own words, "The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing." It is a document an organization downloads and implements — the CSA's pages describe no application, audit or issuance mechanism for the CCM itself. What cloud providers obtain on its basis is a CSA STAR registry entry: "CSPs can use the STAR Level 1 form to self-assess and submit to the STAR Registry, with options to pursue higher certifications or attestations."

The framework is structured in 17 domains. On how many controls those domains hold, CSA's own pages give two different counts for v4.1: the CCM research page says it "is composed of 197 control objectives that are structured in 17 domains covering all key aspects of cloud technology", while the v4.1 artifact page calls it "a cybersecurity control framework made up of 207 controls across 17 security domains". CSA does not define the difference between the two terms, so this page reports both statements rather than choosing one.

Version 4.1 was released on 27 January 2026, and merges the questionnaire into the framework: "Version 4.1 of the CCM and CAIQ are now combined!" In CSA's words, "The CAIQ, built into the CCM, offers a simple set of 'yes/no' questions to assess cloud providers". The CSA also describes the earlier v4 as "the only meta-framework of cloud-specific security controls, mapped to leading standards, best practices, and regulations."

Use of the document is governed by a copyright licence, not an assessment: "You do not need a license if you are using the CCM for internal purposes." For adaptation or commercial use, "A CCM license allows organizations to customize the CCM or use it for commercial purposes."

Who owns it

The Cloud Controls Matrix is published and maintained by the Cloud Security Alliance (CSA), which also runs the STAR programme and registry built on it.