Skip to main content
ControlFrameby LockedIn Labs
Framework library

Requirements & evidence

CSA CCM and CAIQ

The Cloud Security Alliance's cloud-control framework and companion assessment questionnaire for cloud providers and customers. CSA publishes 207 CCM v4.1 controls across 17 domains and 283 CAIQ questions; tracking them does not claim STAR registration, certification, or attestation.

Edition on record
v4.1
Edition published
Source last checked

Understand the scope

What the framework covers.

The library records this framework for cloud services, SaaS, technology, across global. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.

Areas of requirement

  • Cloud governance
  • Shared responsibility
  • Cloud assurance
  • Supplier assessment

207 source entries on record

Control objectives in CSA's CCM v4.1 artifact across 17 domains. The companion CAIQ has 283 questions. Neither catalog is ingested here.

Source access and licensing

Confirm and record CSA's applicable commercial-use terms before importing or distributing catalog text.

Prepare with context

The evidence behind
the requirements.

Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.

A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.

ControlFrame availability

Framework reference available

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

How availability is determined

CSA CCM and CAIQ is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.

Metadata only; the CCM and CAIQ catalogs are not ingested, licensed for product distribution, or released as a module.

Follow the source

Editions and transitions.

These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.

  • v4.1Current edition on record · Replaces v4.0
  • v4.0Superseded edition
    Publication date not recorded
Recorded change history

· CSA CCM and CAIQ v4.1 supersedes v4.0 and is the current edition.

Check the basis

Sources you can follow.

Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.

Catalog provenance and record details

Framework record: csa-ccm-caiq-4-1.

Source artifact: acquisition required.

Parsed catalog: Not ingested.

Control families as published: Cloud governance · Shared responsibility · Cloud assurance · Supplier assessment.

Record last updated: August 30, 2026.

Common questions

A closer look.

What is CSA CCM and CAIQ?

The Cloud Security Alliance's cloud-control framework and companion assessment questionnaire for cloud providers and customers. CSA publishes 207 CCM v4.1 controls across 17 domains and 283 CAIQ questions; tracking them does not claim STAR registration, certification, or attestation.

Who does CSA CCM and CAIQ apply to?

CSA CCM and CAIQ applies to cloud services, SaaS, technology, global, per Cloud Security Alliance.

What is the current version of CSA CCM and CAIQ?

The current edition is v4.1, issued by Cloud Security Alliance and published 2026-01-27. Source: https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4-1.

What does an assessment under CSA CCM and CAIQ require?

207 control units are on record (Control objectives in CSA's CCM v4.1 artifact across 17 domains. The companion CAIQ has 283 questions. Neither catalog is ingested here.), organized into 4 control families: Cloud governance, Shared responsibility, Cloud assurance, Supplier assessment.

At a glance

CSA CCM and CAIQ

v4.1

Framework reference
Authority and edition tracked
Evidence preparation
Framework reference available
Source confidence
Primary authority

A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.

Continue exploring

Related frameworks.

ISO/IEC 27017

Also applies to cloud services · Cloud-specific information security guidance for both cloud customers and providers, extending ISO/IEC 27002 with shared-responsibility and cloud-control guidance. It is guidance, not a standalone certification or a claim about ControlFrame's cloud environment.

CSA AI Controls Matrix

Also applies to cloud services · The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.

CSA STAR

Also applies to cloud services · The Cloud Security Alliance's cloud-assurance program and public registry. Level 1 is a CCM/CAIQ self-assessment; Level 2 is a third-party certification or attestation path. Tracking STAR does not place ControlFrame or any customer on the registry.

ISO/IEC 27018

Also applies to cloud services · Privacy guidance for public-cloud providers acting as processors of personally identifiable information. It complements ISO/IEC 27001 and 27002; it is not a regulation, standalone certification, or claim that ControlFrame is certified.

Make the requirements
part of the work.

Explore how ControlFrame can organize CSA CCM and CAIQ requirements, evidence preparation, and review for your assessment scope.

Request a walkthrough
CSA CCM and CAIQ | ControlFrame