CSA Cloud Controls Matrix

Supply chain management, software integrity, component inventory, license management.


Short name	CSA CCM
Region	International
Country or scope	International
Sector	Cloud
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CSA CCM

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for CSA CCM.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for CSA CCM and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CSA-CCM-STA-INV` Supply Chain Inventory	Providers must develop and maintain an inventory of their supply chain relationships and the software components delivered through them (CCM v4, STA domain - supply chain inventory control)	Scan
`CSA-CCM-STA-SUP` Supply Chain Partner Attribution	Supply-chain risk management requires identifying the upstream provider of each software component so obligations can be flowed down and risk assessed per supplier (CCM v4, STA domain - supply chain risk management)	Scan
`CSA-CCM-AIS-INT` Application Component Integrity	Application and interface security requires assurance that deployed software has not been tampered with, evidenced by integrity hashes on components (CCM v4, AIS domain - application security / integrity verification)	Scan
`CSA-CCM-TVM-VER` Vulnerability Remediation Visibility	Threat and vulnerability management requires knowing the version of each deployed component so vulnerabilities can be matched and remediation tracked (CCM v4, TVM domain)	Scan
`CSA-CCM-GRC-LIC` Licence Compliance	Governance and compliance obligations extend to intellectual-property terms of third-party software, requiring licence information on components (CCM v4, GRC/STA domains - licence management)	Scan
`CSA-CCM-A&A-DOC` Auditable Assurance Documentation	Audit and assurance controls require that evidence artefacts be identifiable and dated, met by SBOMs carrying document identity and creation timestamps (CCM v4, A&A domain)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CCM-AIS-01`	Apply Secure SDLC Across Cloud-Native Applications
`CCM-CEK-01`	Manage Cloud Encryption Keys with Hardware Security Modules
`CCM-DCS-01`	Control Physical Access to Cloud Data Centers
`CCM-HRS-01`	Conduct Security Background Checks for Cloud Personnel
`CCM-IPY-01`	Manage Cloud Service Interoperability and Portability
`CCM-STA-01`	Assess and Monitor Cloud Supply Chain Risk
`CCM-UEM-01`	Manage Endpoint Security for Cloud Access

Policy templates

Written for CSA CCM:

Cloud Controls Matrix Compliance Policy (CSA CCM v4)

And 22 from the standard set, adapted to CSA CCM.