CSA CCM

1. 2026-10-27 Low
   CSA launches STAR for AI Level 2 for AI governance and trust assurance

   The Cloud Security Alliance has released STAR for AI Level 2, a framework that allows organizations to extend their existing industry certifications and assurance frameworks into …

   New document Effective 2026-10-27

1. 2026-01-27 CCM v4.1 and CAIQ v4.1 released
2. 2021-01-21 CCM v4 released

1. 2026-01-27
   CCM v4.1 RevisionCurrent

   Succeeded CCM v4.0.13 with 11 new control specifications and one Identity and Access Management control removed, for 207 controls across 17 domains. source

   More

   • New control specifications are in Datacenter Security, Logging and Monitoring, Security Incident Management, Supply Chain Management and Threat and Vulnerability Management.
   • Existing control objectives were revised and control language refined for clarity and auditing.
   • CAIQ v4.1, released with it, has 283 questions aligned with the latest controls.
   • The download includes mappings to NIST SP 800-171 rev.2 and MITRE ATT&CK v17.1 and a DORA reverse mapping, plus a CAIQ v4.0.3 to v4.1 change analysis.
2. 2021-01-21
   CCM v4 Major version

   Major upgrade from v3.0.1: a new Logging and Monitoring domain, 17 domains and 197 controls (up from 133). source

   More

   • Existing domains were modified, including governance, risk and compliance; audit and assurance; unified endpoint management; and cryptography, encryption and key management.

A cloud security control framework used to assess cloud implementations and to split responsibilities between cloud providers and customers.

What it is

A cybersecurity control framework of 207 controls across 17 security domains in v4.1, which CSA calls the standard for cloud security and privacy. source

Shared responsibility

The CCM provides guidance on which security controls should be implemented by which actor within the cloud supply chain, and defines security roles between providers and customers. source

CAIQ questionnaire

The Consensus Assessment Initiative Questionnaire (CAIQ), built into the CCM, is a set of yes/no questions for assessing cloud providers. source

Mappings

The CCM maps to industry standards including ISO, NIST and PCI; v4.1 mappings to other standards are being updated from those published with v4.0.13. source source

Licence

No licence is needed for internal use; a CCM licence is needed to customize the CCM or use it for commercial purposes, products or consulting. source

Through CSA STAR: Level 1 is a CAIQ self-assessment published in the STAR Registry; Level 2 is a third-party STAR Attestation (SOC 2) or STAR Certification (ISO/IEC 27001).

STAR Level 1

Cloud providers submit the CAIQ to document compliance with the CCM; the result becomes publicly available in the STAR Registry. STAR Self-Assessments are updated annually. source

STAR Attestation (Level 2)

A third-party SOC 2 engagement by CPAs using AICPA criteria together with the CCM. Attestation listings expire after one year unless updated. source

STAR Certification (Level 2)

A third-party assessment combining ISO/IEC 27001 requirements with the CCM; certificates follow ISO/IEC 27001 protocol and expire after three years unless updated. source

Move to v4.1 in STAR

Both v4.0 and v4.1 submissions are accepted until December 2027; from then, STAR Level 1 and Level 2 submissions must be based on v4.1, and existing registry entries have a two-year transition period. source

Withdrawal of v4.0

CSA's transition timeline lists January 2028 for withdrawal of CCM v4.0.x and CAIQ v4.0.x. source

CSA enforces through STAR listings and licensing: attestation and certification listings expire unless updated, and commercial use of the CCM needs a licence.

Listings expire

STAR Attestation listings expire after one year and STAR Certification certificates after three years unless updated. source

Commercial licence

Using the CCM in products, services or consulting projects, or customizing it, requires a CCM licence. source

1. Standard Cloud Controls Matrix and CAIQ v4.1
2. Guidance CCM v4.1 Transition Timeline
3. Guidance Cloud Controls Matrix overview
4. Guidance CSA STAR program

1. ISO 27017

   ISO/IEC 27017 is an ISO code of practice for cloud security controls; the CCM is CSA's own control matrix and is assessed through CSA STAR.

2. ISO 27001

   ISO/IEC 27001 certifies a management system; STAR Certification combines an ISO/IEC 27001 audit with the CCM controls.

3. SOC 2

   SOC 2 reports against the AICPA Trust Services Criteria; STAR Attestation is a SOC 2 engagement that adds the CCM as criteria.

4. Germany C5

   C5 is the German BSI cloud criteria catalogue; the CCM is a global cloud control matrix from CSA.

5. CSA IoT SCF

   CSA's IoT controls framework covers systems built from connected devices; the CCM covers cloud services.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to CSA CCM (RSS)