CSA IoT SCF
CSA IoT Controls Matrix (formerly IoT Security Controls Framework) — Cloud Security Alliance (CSA)
Also known as: CSA IoT SCF, IoT Security Controls Framework, CSA IoT Security Controls Framework, IoT SCF, IoT Controls Matrix, CSA IoT Controls Matrix
Official site Official change log Subscribe to CSA IoT SCF (RSS)
At a glance
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Enterprise IoT systems that combine multiple types of connected devices, cloud services and networking technologies, from low-value data systems to systems supporting critical services. source
- How it is assessed
- The organization uses the matrix itself to evaluate and implement an IoT system, following CSA's companion guide. source
- Written by
- Published by the Cloud Security Alliance (CSA). Version 3 carries the name IoT Controls Matrix; versions 1 and 2 were called the IoT Security Controls Framework. source source
- Last change
- None recorded yet
CSA's control set for enterprise IoT systems that mix connected devices, cloud services and networks, from low-value data systems to systems supporting critical services. It is published with a companion guide for applying the controls.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesVersion history
-
IoT Controls Matrix v3 Major versionCurrent
Increased the number of controls from 155 to 198 and added an Incident Management domain. source
More
- Improved technical clarity of controls and references.
- Released with a companion Guide to the IoT Controls Matrix v3.
-
IoT Security Controls Framework v2 Major version
Reviewed and updated all controls and restructured the control domains, adding Legal and Security Testing domains. source
More
- Device types were consolidated to a single type to simplify allocating controls to architectural components.
- Released with a Guide to the IoT Security Controls Framework Version 2.
-
IoT Security Controls Framework (v1) Major version
First release, introducing base-level security controls for IoT systems that combine connected devices, cloud services and networking technologies. source
Who it applies to
Enterprise IoT systems of any sensitivity; the system owner classifies the system and picks the controls that fit it.
- Systems covered
- Enterprise IoT systems that incorporate multiple types of connected devices, cloud services and networking technologies. source
- Range of systems
- It applies from systems processing only "low-value" data with limited impact potential to highly sensitive systems that support critical services. source
- Classification
- The system owner assigns the classification, based on the value of the data stored and processed and the potential impact of physical security threats. source
- Allocating controls
- The framework helps users identify appropriate security controls and allocate them to specific components within their IoT system. source
How compliance is assessed
The organization uses the matrix itself to evaluate and implement an IoT system, following CSA's companion guide.
- Companion guide
- The Guide to the IoT Controls Matrix v3 explains, column by column, how to use the matrix to evaluate and implement an IoT system for an organization. source
Enforcement and penalties
CSA publishes the framework as a free download.
- Free download
- CSA makes the framework available to download for free. source
Documents
- Standard IoT Controls Matrix v3
- Guidance Guide to the IoT Controls Matrix v3
- Standard CSA IoT Security Controls Framework v2 (previous version)
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 11 September 2026. Subscribe to CSA IoT SCF (RSS)