Cloud Controls Matrix v4.0

The Cloud Controls Matrix is a set of controls designed to be used by both cloud service consumers as well as providers. The CCM includes both technical and administrative controls that can be used to provide security for cloud technology adoption or implementations.

Cloud Controls Matrix v4.0
IDNameThreats
A&A-01Audit and Assurance Policy and ProceduresSTRIDE-LM
A&A-02Independent AssessmentsSTRIDE-LM
A&A-03Risk Based Planning AssessmentSTRIDE-LM
A&A-04Requirements ComplianceSTRIDE-LM
A&A-05Audit Management ProcessSTRIDE-LM
A&A-06RemediationSTRIDE-LM
AIS-01Application and Interface Security Policy and ProceduresSTRIDE-LM
AIS-02Application Security Baseline RequirementsSTRIDE-LM
AIS-03Application Security MetricsSTRIDE-LM
AIS-04Secure Application Design and DevelopmentSTRIDE-LM
AIS-05Automated Application Security TestingSTRIDE-LM
AIS-06Automated Secure Application DeploymentSTRIDE-LM
AIS-07Application Vulnerability RemediationSTRIDE-LM
BCR-01Business Continuity Management Policy and ProceduresSTRIDE-LM
BCR-02Risk Assessment and Impact AnalysisSTRIDE-LM
BCR-03Business Continuity StrategySTRIDE-LM
BCR-04Business Continuity PlanningSTRIDE-LM
BCR-05DocumentationSTRIDE-LM
BCR-06Business Continuity ExercisesSTRIDE-LM
BCR-07CommunicationSTRIDE-LM
BCR-08BackupSTRIDE-LM
BCR-09Disaster Response PlanSTRIDE-LM
BCR-10Response Plan ExerciseSTRIDE-LM
BCR-11Equipment RedundancySTRIDE-LM
CCC-01Change Management Policy and ProceduresSTRIDE-LM
CCC-02Quality TestingSTRIDE-LM
CCC-03Change Management TechnologySTRIDE-LM
CCC-04Unauthorized Change ProtectionSTRIDE-LM
CCC-05Change AgreementsSTRIDE-LM
CCC-06Change Management BaselineSTRIDE-LM
CCC-07Detection of Baseline DeviationSTRIDE-LM
CCC-08Exception ManagementSTRIDE-LM
CCC-09Change RestorationSTRIDE-LM
CEK-01Encryption and Key Management Policy and ProceduresSTRIDE-LM
CEK-02CEK Roles and ResponsibilitiesSTRIDE-LM
CEK-03Data EncryptionSTRIDE-LM
CEK-04Encryption AlgorithmSTRIDE-LM
CEK-05Encryption Change ManagementSTRIDE-LM
CEK-06Encryption Change Cost Benefit AnalysisSTRIDE-LM
CEK-07Encryption Risk ManagementSTRIDE-LM
CEK-08CSC Key Management CapabilitySTRIDE-LM
CEK-09Encryption and Key Management AuditSTRIDE-LM
CEK-10Key GenerationSTRIDE-LM
CEK-11Key PurposeSTRIDE-LM
CEK-12Key RotationSTRIDE-LM
CEK-13Key RevocationSTRIDE-LM
CEK-14Key DestructionSTRIDE-LM
CEK-15Key ActivationSTRIDE-LM
CEK-16Key SuspensionSTRIDE-LM
CEK-17Key DeactivationSTRIDE-LM