CSA STAR / CCM v4
The Cloud Controls Matrix, on your evidence
The Cloud Security Alliance STAR program, built on the Cloud Controls Matrix (CCM v4): 197 controls across 17 domains, with your STAR level and CAIQ self-assessment, a certified-scope page, and a live cross-walk that shows where an operating ISO 27001 control already covers a CCM requirement.
197
CCM controls
17
domains
CAIQ
self-assessment
- 197 CCM v4 controls
- STAR level & CAIQ
- Cloud scope & system description
- Richest ISO 27001 cross-walk
What’s in the module
STAR, built on the Cloud Controls Matrix
The Cloud Security Alliance’s assurance program, instantiated with the full CCM v4 — and mapped to the ISO 27001 you may already run.
- 01
197 CCM v4 controls
Every control across the 17 CCM domains — A&A, IAM, DSP, TVM and the rest — instantiated with real text, not a re-labelled ISO set.
- 02
STAR level & CAIQ
Record your STAR level and assessment type, and build the CAIQ self-assessment on the same evidence as your other frameworks.
- 03
Cloud scope & system description
A structured scope page — CSP, STAR level and an AI-draftable system description — ready for the STAR registry submission.
- 04
Richest ISO 27001 cross-walk
Each CCM control shows whether an operating ISO 27001 Annex A control already covers it, so your ISMS work carries across.
How it runs
From CCM controls to a STAR submission
CCM v4, domain by domain
All 197 controls across the 17 CCM domains, grouped and scored so coverage by domain is visible at a glance — not a spreadsheet you re-derive each cycle.
STAR level & CAIQ
Record your STAR level and assessment type, and answer the CAIQ from the same controls and evidence as the rest of your workspace — with an AI-draftable system description for the registry.
Covered by ISO 27001 already
The richest cross-walk we maintain shows, per CCM control, whether an operating ISO 27001 Annex A control already satisfies it — so your ISMS work carries straight across.
See CSA STAR readiness on your controls
Bring your cloud estate and we’ll show the CCM domains, your CAIQ and the ISO 27001 overlap — live.