Skip to main content
—
Framework library
Framework module · csa-aicm-v1-1

CSA AI Controls Matrix

The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.

v1.1 · Cloud Security Alliance · published 2026-06-22

Standing today
Directory entry

00Answer

from the registry record
What is CSA AI Controls Matrix?
The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.
Who does CSA AI Controls Matrix apply to?
CSA AI Controls Matrix applies to AI, cloud services, SaaS, technology, global, per Cloud Security Alliance.
What is the current version of CSA AI Controls Matrix?
The current edition is v1.1, issued by Cloud Security Alliance and published 2026-06-22. Source: https://cloudsecurityalliance.org/artifacts/ai-controls-matrix-v1-1.
What does an assessment under CSA AI Controls Matrix require?
247 control units are on record (Control objectives across 18 domains in CSA AICM v1.1. The count does not include AI-CAIQ questions, mappings, or guidance, and the catalog is not ingested here.), organized into 5 control families: AI governance and oversight, Model security, Data security and privacy, AI lifecycle assurance, Audit and accountability.

01Standing

Directory entry

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

CSA AI Controls Matrix is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

CSA publishes downloadable and machine-readable AICM materials. Confirm the applicable CSA attribution, redistribution, and commercial product-integration terms before ingestion or embedding.

Request this frameworkAuthority source (opens in a new tab)

02Registry record

checked 2026-08-30
Registry status
Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
Control units
247Control objectives across 18 domains in CSA AICM v1.1. The count does not include AI-CAIQ questions, mappings, or guidance, and the catalog is not ingested here.
Control families
AI governance and oversight · Model security · Data security and privacy · AI lifecycle assurance · Audit and accountability
Applies to
AI · cloud services · SaaS · technology · global
Verification
Primary — the issuing body's own page was read and states this version. checked 2026-08-30

03Version ledger

2 editions
v1.0Superseded2025-07-09
v1.1Current edition · supersedes v1.02026-06-22

05Change history

Full tracker
  1. 2026-06-22
    CSA AI Controls Matrix v1.1 supersedes v1.0 and is the current edition.

06Related frameworks

scored from registry facts
  1. AIUC-1Q3 2026 (2026-07-15 release)

    Also applies to AI · A quarterly updated standard and certification program for AI agents covering data and privacy, security, safety, reliability, accountability, and societal risk. Only AIUC can issue its certificate; registry inclusion makes no certification claim.

  2. OWASP Agentic Top 102026

    Also applies to AI · OWASP's peer-reviewed risk framework for autonomous and agentic AI applications, including systems that plan, use tools, hold memory, or coordinate multi-step workflows. It is guidance, not a certification.

  3. CSA STARSTAR Level 1 and Level 2

    Also applies to cloud services · The Cloud Security Alliance's cloud-assurance program and public registry. Level 1 is a CCM/CAIQ self-assessment; Level 2 is a third-party certification or attestation path. Tracking STAR does not place ControlFrame or any customer on the registry.

  4. CSA CCM and CAIQv4.1

    Also applies to cloud services · The Cloud Security Alliance's cloud-control framework and companion assessment questionnaire for cloud providers and customers. CSA publishes 207 CCM v4.1 controls across 17 domains and 283 CAIQ questions; tracking them does not claim STAR registration, certification, or attestation.

See control-level overlap in the Control Atlas
CSA AI Controls Matrix | ControlFrame