The Cloud Security Alliance (CSA) has developed a cybersecurity control architecture called the Cloud Controls Matrix (CCM). It's a spreadsheet detailing sixteen categories that span all of the important facets of cloud computing. A total of 133 individual control goals are spread throughout the various domains. By outlining which actors in the cloud supply chain should be responsible for implementing particular security measures, it may be used as a tool for systematic assessment of cloud deployment. Aligned with Security Guidance v4, the controls architecture is widely accepted as an industry benchmark for cloud security assurance and compliance. You may find CCM v3 localizations here.
Cloud certification courses will add more value to your resume.
STANDARDIZE CONTROLS, REGULATIONS, AND STANDARDS
The CCM controls are matched to widely used security frameworks, policies, and standards. The CCM v4 is currently mapped to the following:
- ISO/IEC 27001/27002/27017/27018
- CCM V3.0.1
- CIS Controls V8.
- Additional mappings for AICPA TSC, PCI-DSS and NIST 8-53 Rev.5 are under development and other new mappings will also be added in the future.
The previous version of the CCM v3.0.1 is mapped to the following standards:
- ISO 27001/27002/27017/27018
- NIST SP 800-53
- AICPA TSC
- German BSI C5
- PCI DSS
- ISACA COBIT
- NERC CIP
- FedRamp
- CIS
·
And many others...
HOW DOES IT WORK?
Common standards and laws that enterprises must follow are included in the Cloud Controls Matrix, a spreadsheet. Fulfilling the CCM controls also satisfies the requirements of the standards and regulations to which they map. By consolidating the most popular cloud standards into a single location, it lowers the need for using various frameworks and makes cloud security easier to implement. The user is dynamically able to examine, for each control, the various criteria it meets. For instance, meeting the requirements of three separate rules and frameworks may be accomplished by just being in conformance with a single control.
Each control in the CCM specifies the cloud model type (IaaS, PaaS, SaaS) or cloud network environment (public, hybrid, private) to which it applies and who is responsible for enforcing the rule (the CSP or cloud customer). By outlining which control advice is applicable to a cloud service provider and a cloud client, the CCM helps to define the respective duties of each.
FOR CLOUD CUSTOMERS
Evaluate Cloud Service Providers Using the CCM or Use it in Lieu of a Request for Proposal.
Similar to the CCM, the Consensus Assessments Initiative Questionnaire (CAIQ) presents a list of yes/no questions that a cloud user or auditor would want to ask a cloud service. Using the CCM's security controls as a guide, the questions may be used to compile evidence of the presence or absence of security controls in a provider's IaaS, PaaS, and SaaS services. In order to get greater security, several businesses utilize the CAIQ as a foundation for a request for proposal (RFP). The veracity of a vendor's responses during the RFP interview may then be checked by the requesting organization. As of right now, the CAIQ has been adopted by more than 500 different organizations for use in submitting STAR registry self-assessments.
FOR CLOUD SOLUTION PROVIDERS (CSPS)
Make Use of the CCM When Submitting to the CSA's Database
Security posture ratings on the Security, Trust, Assurance, and Risk (STAR) registry are compared to the CCM. The STAR program advocates for certifications to be adaptable, gradual, and multi-layered, with the ability to interact with widely used third-party examinations to cut down on unnecessary time and money spent. Providers of security services may prove their firm's adherence to applicable policies, guidelines, and frameworks by completing the CCM-aligned portion of an extended question set. Providers should submit the finalized CAIQ to the STAR Registry so that it may be accessed by the general public.
Several reputed institutes now offer cloud computing online courses too.
SECURITY DOMAINS COVERED BY THE CCM
The latest version of the CSA Cloud Controls Matrix, version 4.0, is presently under development. Changes to the framework's structure, including the addition of a new domain for Log and Monitoring (LOG), and tweaks to the current domains make CCM v.4 a substantial improvement over its predecessor, version 3.0.1. (GRC, A&A, UEM, CEK). As a consequence of creating new controls and improving upon old ones, this revision will also bring with it a substantial rise in requirements.
The CCM v.4 version also includes the following new capabilities:
Protection against gaps in service caused by the emergence of new cloud computing standards
Matrix of new responsibilities and controls for cyber security
Controls that are more easily audited and that work better with other standards in terms of interoperability and compatibility.
Updated in version 4, the Cloud Controls Matrix (CCM) now includes coverage in the following areas:
- Application & Interface Security
- Audit and Assurance
- Business Continuity Mgmt & Op Resilience
- Change Control & Configuration Management
- Data Security & Privacy Lifecycle Management
- Datacenter Security
- Cryptography, Encryption and Key Management
- Governance, Risk Management and Compliance
- Human Resources Security
- Identity & Access Management
- Security Infrastructure & Virtualization
- Interoperability & Portability
- Universal EndPoint Management
- Security Incident Management, E-Discovery & Cloud Forensics
- Supply Chain Management, Transparency & Accountability
- Threat & Vulnerability Management
- Logging and Monitoring
WHAT HAPPENS IF A NEW LAW OR INDUSTRY STANDARD EMERGES THAT CCM V. 1.0 DOES NOT ACCOUNT FOR?
When a new framework or rule comes into effect in a particular area, CSA will publish a CCM mapping to help businesses comply. Here is a complete catalog of Cloud Controls Matrix (CCM) mappings.
RECENTLY UPDATED CCM MAPPINGS
Gap Analysis Report
The Singapore Banking Association's Cloud Computing Implementation Guide 2.0 is mapped to the Cloud Security Alliance's Cloud Controls Matrix v3.0.1 Enterprise Architecture and the CCM Shared Responsibility Model.
CSA CCM v3.0.1 Addendum
Cloud OS Security Specifications
Mapping of 'The Guidelines' Security Recommendations to CCM
CCM v3.0.1 Addendum - FedRAMP Moderate
CSA CCM v3.0.1 Addendum - NIST 800-53 Rev 4 Moderate
CSA CCM v3.0.1 Addendum - AICPA TSC 2017
A cloud architect course will enhance your knowledge and skills.
AllianceTek - Get complete Cloud Computing solutions like architecture, Application development, software development services & Cloud Computing SaaS to slash information technology costs and empower employees to work on any device wherever they are, maximizing performance.
