Skip to main content
—
Framework library
Framework module · csa-ccm-caiq-4-1

CSA CCM and CAIQ

The Cloud Security Alliance's cloud-control framework and companion assessment questionnaire for cloud providers and customers. CSA publishes 207 CCM v4.1 controls across 17 domains and 283 CAIQ questions; tracking them does not claim STAR registration, certification, or attestation.

v4.1 · Cloud Security Alliance · published 2026-01-27

Standing today
Directory entry

00Answer

from the registry record
What is CSA CCM and CAIQ?
The Cloud Security Alliance's cloud-control framework and companion assessment questionnaire for cloud providers and customers. CSA publishes 207 CCM v4.1 controls across 17 domains and 283 CAIQ questions; tracking them does not claim STAR registration, certification, or attestation.
Who does CSA CCM and CAIQ apply to?
CSA CCM and CAIQ applies to cloud services, SaaS, technology, global, per Cloud Security Alliance.
What is the current version of CSA CCM and CAIQ?
The current edition is v4.1, issued by Cloud Security Alliance and published 2026-01-27. Source: https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4-1.
What does an assessment under CSA CCM and CAIQ require?
207 control units are on record (Control objectives in CSA's CCM v4.1 artifact across 17 domains. The companion CAIQ has 283 questions. Neither catalog is ingested here.), organized into 4 control families: Cloud governance, Shared responsibility, Cloud assurance, Supplier assessment.

01Standing

Directory entry

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

CSA CCM and CAIQ is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Confirm and record CSA's applicable commercial-use terms before importing or distributing catalog text.

Request this frameworkAuthority source (opens in a new tab)

02Registry record

checked 2026-08-30
Registry status
Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
Control units
207Control objectives in CSA's CCM v4.1 artifact across 17 domains. The companion CAIQ has 283 questions. Neither catalog is ingested here.
Control families
Cloud governance · Shared responsibility · Cloud assurance · Supplier assessment
Applies to
cloud services · SaaS · technology · global
Verification
Primary — the issuing body's own page was read and states this version. checked 2026-08-30

03Version ledger

2 editions
v4.0Supersededdate not published
v4.1Current edition · supersedes v4.02026-01-27

05Change history

Full tracker
  1. 2026-01-27
    CSA CCM and CAIQ v4.1 supersedes v4.0 and is the current edition.

06Related frameworks

scored from registry facts
  1. ISO/IEC 270172026

    Also applies to cloud services · Cloud-specific information security guidance for both cloud customers and providers, extending ISO/IEC 27002 with shared-responsibility and cloud-control guidance. It is guidance, not a standalone certification or a claim about ControlFrame's cloud environment.

  2. CSA AI Controls Matrixv1.1

    Also applies to cloud services · The Cloud Security Alliance's vendor-neutral control framework for cloud-based AI systems, with implementation and auditing guidance plus the companion AI-CAIQ. It is a control catalog, not by itself a certification or STAR for AI designation.

  3. CSA STARSTAR Level 1 and Level 2

    Also applies to cloud services · The Cloud Security Alliance's cloud-assurance program and public registry. Level 1 is a CCM/CAIQ self-assessment; Level 2 is a third-party certification or attestation path. Tracking STAR does not place ControlFrame or any customer on the registry.

  4. ISO/IEC 270182025

    Also applies to cloud services · Privacy guidance for public-cloud providers acting as processors of personally identifiable information. It complements ISO/IEC 27001 and 27002; it is not a regulation, standalone certification, or claim that ControlFrame is certified.

See control-level overlap in the Control Atlas
CSA CCM and CAIQ | ControlFrame