Cloud Controls Matrix v4.0

The Cloud Controls Matrix is a set of controls designed to be used by both cloud service consumers as well as providers. The CCM includes both technical and administrative controls that can be used to provide security for cloud technology adoption or implementations.

Cloud Controls Matrix v4.0
IDNameThreats
AIS-02Application Security Baseline RequirementsSTRIDE-LM
AIS-04Secure Application Design and DevelopmentSTRIDE-LM
AIS-07Application Vulnerability RemediationSTRIDE-LM
CEK-01Encryption and Key Management Policy and ProceduresSTRIDE-LM
CEK-03Data EncryptionSTRIDE-LM
CEK-04Encryption AlgorithmSTRIDE-LM
CEK-05Encryption Change ManagementSTRIDE-LM
CEK-07Encryption Risk ManagementSTRIDE-LM
CEK-08CSC Key Management CapabilitySTRIDE-LM
CEK-09Encryption and Key Management AuditSTRIDE-LM
CEK-12Key RotationSTRIDE-LM
CEK-14Key DestructionSTRIDE-LM
CEK-19Key CompromiseSTRIDE-LM
DCS-01Off-Site Equipment Disposal Policy and ProceduresSTRIDE-LM
DCS-02Off-Site Transfer Authorization Policy and ProceduresSTRIDE-LM
DCS-04Secure Media Transportation Policy and ProceduresSTRIDE-LM
DCS-09Secure Area AuthorizationSTRIDE-LM
DCS-12Cabling SecuritySTRIDE-LM
DSP-02Secure DisposalSTRIDE-LM
DSP-03Data InventorySTRIDE-LM
DSP-04Data ClassificationSTRIDE-LM
DSP-07Data Protection by Design and DefaultSTRIDE-LM
DSP-08Data Privacy by Design and DefaultSTRIDE-LM
DSP-09Data Protection Impact AssessmentSTRIDE-LM
DSP-10Sensitive Data TransferSTRIDE-LM
DSP-13Personal Data Sub-processingSTRIDE-LM
DSP-15Limitation of Production Data UseSTRIDE-LM
DSP-16Data Retention and DeletionSTRIDE-LM
DSP-17Sensitive Data ProtectionSTRIDE-LM
HRS-03Clean Desk Policy and ProceduresSTRIDE-LM
HRS-05Asset returnsSTRIDE-LM
HRS-06Employment TerminationSTRIDE-LM
HRS-10Non-Disclosure AgreementsSTRIDE-LM
HRS-12Personal and Sensitive Data Awareness and TrainingSTRIDE-LM
IAM-05Least PrivilegeSTRIDE-LM
IAM-16Authorization MechanismsSTRIDE-LM
IVS-03Network SecuritySTRIDE-LM
LOG-10Encryption Monitoring and ReportingSTRIDE-LM
SEF-07Security Breach NotificationSTRIDE-LM
STA-10Supply Chain Agreement ReviewSTRIDE-LM
STA-14Supply Chain Data Security AssessmentSTRIDE-LM
TVM-05External Library VulnerabilitiesSTRIDE-LM
TVM-06Penetration TestingSTRIDE-LM
UEM-06Automatic Lock ScreenSTRIDE-LM
UEM-08Storage EncryptionSTRIDE-LM
UEM-11Data Loss PreventionSTRIDE-LM
UEM-13Remote WipeSTRIDE-LM