Map your cloud controls to CSA CCM v4.1 with less manual effort

The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing, published by the Cloud Security Alliance. Version 4.1 contains 207 controls across 17 security domains, covering areas such as identity and access management, encryption and key management, logging and supply chain management. It maps to other standards and underpins the CAIQ questionnaire and the CSA STAR assurance programme.

No. The CCM is a voluntary framework and no law requires it. Cloud service providers adopt it because enterprise customers and procurement teams often ask for a completed CAIQ or a CSA STAR listing as evidence of cloud security. In practice it can become a commercial or contractual expectation, especially when selling cloud or SaaS services to larger organisations.

CCM v4.1, released by CSA in January 2026, adds 11 new controls in the Datacenter Security, Logging and Monitoring, Security Incident Management, Supply Chain Management and Threat & Vulnerability Management domains, and removes one Identity and Access Management control. The total is now 207 controls across the same 17 domains. Control wording was refined and the CAIQ was updated to 283 questions.

The CCM is the control framework, the CAIQ is a questionnaire of yes or no questions used to assess those controls, and CSA STAR is the assurance programme and public registry. At STAR Level 1, organisations submit a CAIQ self-assessment. At STAR Level 2, they earn a third-party certification or attestation against the CCM.

CCM complements both. CSA publishes mappings from the CCM to other standards, and STAR Level 2 builds on existing audits: STAR Certification is combined with an ISO/IEC 27001 certification, and STAR Attestation is combined with a SOC 2 report. If you already hold ISO 27001 or SOC 2, much of your existing control evidence can be reused for CCM.

CSA accepts both v4.0 and v4.1 submissions during a transition period. According to CSA's published timeline, from December 2027 only v4.1-based STAR Level 1 and Level 2 submissions will be accepted, and CCM and CAIQ v4.0.x will be withdrawn in January 2028. Organisations already on the STAR Registry have a two-year window to switch.

Start by scoping your cloud services and deciding which controls are your responsibility under the shared security responsibility model. Then implement and evidence the controls across the 17 domains, complete the CAIQ, and consider submitting it to the STAR Registry. For higher assurance, engage an auditor for STAR Level 2 certification or attestation alongside ISO 27001 or SOC 2.

Yes. OneClickComply supports CSA CCM v4.1 today. Controls and evidence you already maintain for frameworks such as ISO 27001 or SOC 2 can be shown against the 17 CCM domains, and questionnaire automation helps with CAIQ-style questions. OneClickComply does not issue CSA STAR certification.