Cloud service providers, cloud customers, assessors and procurement teams can use the matrix for a specific service and deployment model.
Practice frameworks / Cloud control framework
CSA Cloud Controls Matrix v4.1Make cloud controls and responsibility visible
A cloud-focused control framework and assessment language that helps providers and customers examine control design, shared responsibility and service assurance.
Start with applicability
What it actually covers
Cloud risk often falls between provider and customer; CCM helps make those boundaries, control questions and supporting evidence explicit.
The matrix is not a stand-alone legal compliance claim or automatic certification. CAIQ self-assessment and third-party STAR attestation or certification have different assurance levels. Use the dedicated STAR Level 1 CAIQ for registry submission, not the reference copy bundled with the matrix.
The substance
Key areas to understand
An original operational reading of the official framework or legal text. Check the source for the authoritative wording.
207 controls in 17 domains
The domains cover governance, identity, data, infrastructure, application, logging, supplier, incident, resilience and other cloud concerns. The matrix supplies a consistent control vocabulary.
Shared responsibility
The same control may be operated by a provider, a customer or both depending on the service model and contract. Record the actual split for each in-scope service.
CAIQ
The Consensus Assessments Initiative Questionnaire turns controls into provider assessment questions. A dedicated v4.1 version supports STAR Level 1 submissions.
Implementation and metrics
CSA provides implementation guidance, auditing guidance and metric resources; use them to assess whether a control works rather than treating an answer as proof.
STAR assurance
Level 1 is a provider self-assessment. Level 2 adds independent attestation or certification through the relevant STAR route, such as SOC 2 based attestation or ISO/IEC 27001 based certification.
From reference to work
A practical starting sequence
These steps organize work; they are not a claim that a short checklist completes the requirement.
Select a cloud service
Define the specific provider service, data, tenants, regions, interfaces and service model that the assessment will cover.
Allocate control ownership
Map each relevant control to provider, customer or joint responsibility using architecture and contract facts rather than a generic cloud model.
Ask for verifiable answers
Use CAIQ and supporting records to probe control operation, exceptions and the handling of subcontractors.
Review the assurance level
Check whether evidence is a self-assessment, STAR attestation or certification; verify current registry status and the service scope.
Make it inspectable
Evidence to look for
The right records depend on the entity, scope and chosen assessment route.
- Shared-responsibility matrix
A service-specific allocation of control tasks to provider, customer and subcontractors.
- CAIQ and supporting records
Current answers linked to configuration, policy, monitoring and test evidence for the service.
- Provider assurance
Relevant STAR listing, SOC 2 report or ISO/IEC 27001 certificate with scope and dates, when available.
- Exceptions and review trail
Risk decisions, gaps, contract dependencies and scheduled reassessment after architecture or provider changes.
Illustrative situation
What this could look like
A company procures a SaaS analytics platform. Its team reviews the provider's CAIQ v4.1, confirms who controls encryption keys and identity integration, and checks whether a STAR listing covers the purchased service before recording residual risks.
Keep the role clear
The matrix is not a stand-alone legal compliance claim or automatic certification. CAIQ self-assessment and third-party STAR attestation or certification have different assurance levels. Use the dedicated STAR Level 1 CAIQ for registry submission, not the reference copy bundled with the matrix.
Related, not equivalent
Where ISO/IEC can help
CCM adds cloud-specific detail that can inform ISO/IEC 27001 risk treatment and ISO/IEC 27017 cloud controls. CSA STAR Certification and STAR Attestation use separate assurance routes; a CCM mapping alone is not evidence of ISO conformity.
Common distinctions
Questions worth asking
Is CCM v4.1 the current matrix?
Yes. CSA lists v4.1, released in January 2026, as the latest CCM and CAIQ package with 207 controls in 17 domains.
Is a CAIQ response an independent audit?
No. A STAR Level 1 CAIQ is a self-assessment. STAR Level 2 involves third-party attestation or certification.
Does a CCM mapping prove DORA, GDPR or ISO compliance?
No. Mappings help identify related requirements or controls; scope, legal applicability and actual evidence must be assessed separately.
Primary-source trail
Read the official material
Research checked 2026-10-20. Edition, applicability and implementation rules can change. The links below take you to the responsible publisher or authority.