Requirements & evidence
CSA AI Controls Matrix
The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.
- Edition on record
- v1.1
- Issuing authority
- Cloud Security Alliance (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for AI, cloud services, SaaS, technology, across global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- AI governance and oversight
- Model security
- Data security and privacy
- AI lifecycle assurance
- Audit and accountability
247 source entries on record
Control objectives across 18 domains in CSA AICM v1.1. The count does not include AI-CAIQ questions, mappings, or guidance, and the catalog is not ingested here.
Source access and licensing
CSA publishes downloadable and machine-readable AICM materials. Confirm the applicable CSA attribution, redistribution, and commercial product-integration terms before ingestion or embedding.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
CSA AI Controls Matrix is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; AICM controls, AI-CAIQ questions, mappings, and auditing guidance are not ingested or licensed for product distribution.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- v1.1Current edition on record · Replaces v1.0
- v1.0Superseded edition
Recorded change history
· CSA AI Controls Matrix v1.1 supersedes v1.0 and is the current edition.
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- Cloud Security Alliance (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: csa-aicm-v1-1.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: AI governance and oversight · Model security · Data security and privacy · AI lifecycle assurance · Audit and accountability.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is CSA AI Controls Matrix?
The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.
Who does CSA AI Controls Matrix apply to?
CSA AI Controls Matrix applies to AI, cloud services, SaaS, technology, global, per Cloud Security Alliance.
What is the current version of CSA AI Controls Matrix?
The current edition is v1.1, issued by Cloud Security Alliance and published 2026-06-22. Source: https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1.
What does an assessment under CSA AI Controls Matrix require?
247 control units are on record (Control objectives across 18 domains in CSA AICM v1.1. The count does not include AI-CAIQ questions, mappings, or guidance, and the catalog is not ingested here.), organized into 5 control families: AI governance and oversight, Model security, Data security and privacy, AI lifecycle assurance, Audit and accountability.
At a glance
CSA AI Controls Matrix
v1.1
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize CSA AI Controls Matrix requirements, evidence preparation, and review for your assessment scope.