CAIQ V3 Updates

Cloud Security Alliance (CSA) would like to present the next version of the Consensus Assessments Initiative Questionnaire (CAIQ) v3.1.

The CAIQ offers an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services, providing security control transparency. It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM). Therefore, it helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.

CAIQ v3.1 represents a minor update to the previous CAIQ v3.0.1. In addition to improving the clarity and accuracy, it also supports better auditability of the CCM controls. The new updated version aims to not only correct errors but also appropriately align and improve the semantics of unclear questions for corresponding CCM v3.0.1 controls. In total, 49 new questions were added, and 25 existing ones were revised.

For this new CAIQ version, CSA took into account the combined comprehensive feedback that was collected over the years from its partners, the industry and the CCM working group.

Using The CAIQ-Lite to Assess Third Party Vendors

By Dave Christiansen, Marketing Director, Whistic

The mere mention of “security questionnaires” can evoke thoughts of hundreds of questions aimed at auditing internal processes in order to mitigate third party risk. This typically means a lengthy process prime to be optimized. While we don’t disagree with being thorough when evaluating third party vendors, in order to keep up with the speed cloud-based businesses are moving at, more light-weight standards can serve as excellent “on-ramps” to expedite the vendor risk assessment process.

As you’ve likely heard by now, Whistic and The Cloud Security Alliance collaborated to create the initial release of The CAIQ-Lite in order to encourage the streamlining of vendor security assessment and processes.  The inherent beauty of the CAIQ-Lite lies within its general construct, maintaining the 16 control domains contained within Cloud Controls Matrix 3.0.1 while condensing the total question count from 295 questions down to 73 questions. This does place additional weight on each question within CAIQ-Lite as they were selected based on importance/priority over those that were omitted.

As this new standard was released just three months ago, we’ve received a number of questions pertaining to what ideal use cases look like for CAIQ-Lite. Below is an initial resource list compiled to date:

  • An excellent baseline measurement that can be factored into your risk modeling and reporting.
  • The initial step in a potential multi-step process, aimed at nimbly receiving an initial response & channelling specific vendors on to a full CAIQ assessment, etc.    
  • A good way to quickly audit any “flagged” or questionable status vendors.
  • For any third-parties that may require an increased risk management cadence.
  • Conditions where third-party vendors only have limited-level access to your company’s data.
  • A re-engagement tool for any vendors that haven’t complied in a satisfactory manner previously, or perhaps have been suboptimal when it comes to communicating on this front.
  • An ideal introductory security questionnaire for use by vendors with a newly burgeoning information security team, perhaps lacking robust exposure to lengthier standards.

We continue to compile feedback for this new standard, and encourage CSA members to self-assess against CAIQ-Lite then reach out with any questions and/or suggestions in order to shape the final version of CAIQ-Lite in early 2020.

You may access the CAIQ-Lite Questionnaire online within the Whistic Platform or The CAIQ-Lite Spreadsheet here.

The CAIQ-Lite Whitepaper is also available for download here.

CCM Addenda Updates for Two Additional Standards

By the CSA CCM Working Group

Dear Colleagues,

We’re happy to announce the publication of the updated Cloud Controls Matrix (CCM) Addenda for the following standards:
— German Federal Office for Information Security (BSI) Cloud Computing Compliance Controls Catalogue (C5) 
ISO/IEC 27002, ISO/IEC 27017 and ISO/IEC 27018

These CCM addenda aim to help organizations assess and bridge compliance gaps between the CCM and other security frameworks. 

The documents contain:  

  • A controls mapping between the above mentioned standards and the CCM (e.g. which control(s) in CCM maps to each given control in ISO27017).
  • A gap analysis
  • Compensating controls (i.e. the actual “addendum”)

Additionally, the addendum for the German BSI C5 contains both mappings and reverse mappings.

The CSA and the CCM Working Group hope that organizations will find this document useful for their security compliance programs. 

Best Regards,
CSA CCM Working Group

Weigh in on the Cloud Control Matrix Addenda

Mapping of the cloud controls matrixDear Colleagues,

The Cloud Security Alliance would like to invite you to review and comment on the Cloud Control Matrix (CCM) addenda for the following standards:

—German Federal Office for Information Security (BSI) Cloud Computing Compliance Controls Catalogue (C5). (Add your comments to CCM-C5.)
—ISO/IEC 27002, ISO/IEC 27017 and ISO/IEC 27018. (Add your comments to CCM-ISO.)

These CCM addenda aim to help organizations assess and bridge compliance gaps between the CCM and other security frameworks. The documents contain:

  • a controls mapping between the above mentioned standards and the CCM (e.g., which control(s) in CCM maps to each given control in ISO27017),
  • a gap analysis, and
  • compensating controls (i.e. the actual “addendum”).

The CSA and the CCM Working Group hope that organizations will find this document useful for their security compliance programs.

To participate, please follow the links above to the review site. From there, you should be able to navigate to Google Sheets and provide your comments. Please do not provide editorial comments (i.e. grammar, formatting, etc), rather focus instead on the content of the document.

The peer review ends on December 20, 2018. We appreciate your assistance and thank you in advance for your time and contributions.

Best Regards,
CSA Research Team

Cloud Security Alliance Releases Minor Update to CCM v3.0.1

By the CSA Research Team

CCM logoThe Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) Working Group has released a minor update for the CCM v3.0.1. This update incorporates mappings to IEC 62443-3-3 and BSI Compliance Controls Catalogue (C5).

The CCM is specifically designed to provide fundamental security principles to guide cloud vendors and to assist prospective cloud customers in assessing the overall security risk of a cloud provider. The CSA CCM provides a controls framework that gives detailed understanding of security concepts and principles that are aligned to the Cloud Security Alliance guidance in 13 domains. The foundations of the Cloud Security Alliance Controls Matrix rest on its customized relationship to other industry-accepted security standards, regulations, and controls frameworks such as the ISO 27001/27002, ISACA COBIT, PCI, NIST, Jericho Forum and NERC CIP and will augment or provide internal control direction for service organization control reports attestations provided by cloud providers.

As a framework, the CSA CCM provides organizations with the needed structure, detail and clarity relating to information security tailored to the cloud industry. It strengthens existing information security control environments by emphasizing business information security control requirements, reduces and identifies consistent security threats and vulnerabilities in the cloud, provides standardized security and operational risk management, and seeks to normalize security expectations, cloud taxonomy and terminology, and security measures implemented in the cloud.

The CSA CCM Working Group would like to thank the following individuals for their contributions to this minor update:


  • Claus Matzke
  • Kristian Beckers

CCM Working Group

  • Noel Haskins-Hafer
  • Kris Seeburn
  • Amita Radhakrishnan
  • Angela Dogan
  • Dibya Ranjan Nath
  • Hardeep Mehrotara
  • Jevon Wooden
  • Keith Stocks
  • Leena Singal
  • Loredana Mancini
  • Manjunath A.T.
  • Michael Roza
  • Reid Leake
  • Subrata Baguli
  • Umar Khan
  • Vamsi Kaipa

Please feel free to contact us at [email protected] if you have any queries regarding the update.

If you are interested in participating in future CCM Working Group activities, please feel free to sign up for the working group.

Methodology for the Mapping of the Cloud Controls Matrix

By Victor Chin, Research Analyst, Cloud Security Alliance

CCM Mapping methodologyThe Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) provides fundamental security principles to guide cloud vendors and cloud customers seeking to assess the overall security risk of a cloud service. To reduce compliance fatigue in the cloud services industry, the CCM program also includes controls mappings to other key industry frameworks such as International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001, National Institute of Standards and Technology (NIST) 800-53, and American Institute of Certified Public Accountants (AICPA) Trust Services Criteria (TSC).

Historically, these mappings come from two main sources: third-party organizations and CCM Working Group volunteers. Over time, processes to incorporate these mappings have evolved organically but were not formally documented.

The Methodology for the Mapping of the Cloud Controls Matrix document aims to formally document and enhance these processes. They include a controls mapping methodology, the identification of gaps between two frameworks, the creation of a mapping work package, naming references, and project management guidelines.

By documenting these processes, we aim to fulfill four primary functions:

  1. Provide clarity and transparency regarding the CSA CCM Working Group’s mapping approach, guidelines and naming conventions;
  2. Encourage process review and improvement suggestions by the CSA community;
  3. Yield a valuable reference for organizations—especially those seeking to benefit from and contribute to interoperable efforts by mapping their frameworks to the CCM; and
  4. Improve assessor criteria understanding and interpretation of all mapping processes through criteria mapping exercises.

Moving forward, we hope that this document will be a valuable reference to all key stakeholders in the CCM ecosystem, as well as contribute to the maturity of the CCM program.

The success of the CCM continues to be the result of the dedicated professionals within the CCM Working Group. This document would not have been possible without the expertise, focus, and collaboration of the following working group members:

  • Sean Cordero
  • Ai-Ping Foo
  • Kimberley Laris
  • Ahmed Maaloul
  • Michael Roza
  • Eric Tierling

Download the Methodology for the Mapping of the Cloud Controls Matrix.

Updated CCM Introduces Reverse Mappings, Gap Analysis

By Sean Cordero, VP of Cloud Strategy, Netskope

CCM logoSince its introduction in 2010, the Cloud Security Alliance’s Cloud Control Matrix (CCM) has led the industry in the measurement of cloud service providers (CSP). The CCM framework continues to deliver for CSPs and cloud consumers alike a uniform set of controls to measure the security readiness of a cloud-centric security program. It continues to be the industry standard used to measure, evaluate, and inform risk, information security, and audit professionals on the best practices for securing cloud services.

Consistent with the CSA’s commitment to driving greater trust, assurance, and accountability across the information risk and security industry, this latest expansion to the CCM incorporates the ISO/IEC 27017:2015, ISO/IEC 27018:2014, and ISO/IEC 27002:2013 controls, and introduces a new approach to the development of the CCM and an updated approach to incorporate new industry control standards.

Core to this release of the ISO 27017:2015, 27018:2014, and 27002:2013 reverse mappings and gap analysis were two additional goals defined by the CSA and the CCM Working Group:

  1. Improve the ease of operationalization and measurement for all new controls.
  2. Increase the flexibility for CSPs and cloud consumers adopting additional control frameworks while retaining alignment with the core CCM controls.

Improved ease of operational usage and measurement

The avoidance of overly prescriptive control statements has been central to the CCM’s control development philosophy. This approach was required to avoid duplication across other control frameworks and to avoid rework for security and audit professionals. While this approach is reflected in the language of the CCM, this intentional lack of specificity has made it, at times, challenging to fully integrate into architectural and validation efforts. To address this within the language for the newly developed controls two key changes were made—first, to the alignment of the core of the research team and second, to the method of delivery for new controls.

First, two working group sub-teams were created and leaders of each identified. One group specific to information risk management and the other for audit and control measurement. To ensure that both teams brought to bear their collective expertise across the entire revision, each team then collaborated on the review of the work product of the other team, which has led to the most comprehensive and well-defined release of the CCM to date.

The information security team was led by Ai Ping Foo. Her team focused on the identification and creation of new controls and mappings with a focus on ensuring the incorporation of these controls across security architectures.

The assurance team was led by Ahmed Maaloul, whose team drove the creation of the new controls and mappings with a focus on ensuring control clarity, ease of measurement, and reproducibility for audit and assurance professionals.

Improved flexibility and delivery for new controls

This latest release of the Cloud Controls Matrix introduces reverse mappings and gap analysis to the CCM program. We believe that this approach allows organizations to continue their alignment to the core CCM standard while giving the option of further expanding their controls without disruption to any STAR certification efforts underway or existing certifications.

As the CCM framework continues to mature we are confident it will give security, audit, and assurance professionals the most flexibility for control identification without compromising the existing CCM controls.

The CCM continues to define the standard for trust, assurance, and control for security, audit, and compliance analysts when conducting operations in the cloud. This latest release reflects the CSA’s and the CCM Working Group’s continued commitment towards ease of use, flexibility, and uniformity across the multiple disciplines which enable trusted cloud operations.

The success of the CCM continues to be the result of the dedicated professionals within the CCM Working Group. This latest release would not have been possible without the expertise, focus, and collaboration of the following working group members:

Security Team Leader: Ai Ping Foo

Assurance Team Leader: Ahmed Maaloul

CCM Working Group Volunteers:

Ai Ping Foo

Adnan Dakhwe

Ahmed Maaloul

Angela Dogan

Alejandro del Rio Betancourt

Bunmi Ogun

Chris Sellards

Chris Shull

Eric Tierling

Josep Bardallo

Kazuki Yonezawa

Kelvin Arcelay

Madhav Chablani

Masashiro Morozumi

Mariela Rengel

Mohin Gulzar

Muswagha Katya

Noutcha Gilles

Puneet Thapliyal

Shahid Sharif

Saraj Mohammed

M. Reid Leake

William Butler

Download the latest version of the CSA Cloud Control Matrix.

Sean Cordero has over 18 years of IT and Information Risk Management. He has held senior security executive roles at leading bio-technology, financial, retail, and consulting organizations. Cordero is the Chair of the CSA’s Cloud Control Matrix Working Group and serves as the Co-Chair of the CSA’s Consensus Assessments Initiative Questionnaire. Cordero was honored by the CSA with the Ron Knode Service Award in 2013 and inducted as a CSA Research Fellow in 2016. Cordero is a certified CISSP, CISM, CISA and CRISC.