CSA CCM anchors

Stefan Coetzeecreated 2026-05-12updated 2026-05-121 min readanchors
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Primary documents

  • CSA Cloud Controls Matrix v4 — current.
  • Consensus Assessments Initiative Questionnaire (CAIQ) v4 — companion questionnaire.
  • CSA STAR Program documentation.

Operating body

  • Cloud Security Alliance — csa.org. Founded 2008.

Adjacent CSA work

  • CSA Top Threats reports (annual).
  • Egregious 11 / Pandemic 11 — top cloud security threats.
  • CSA AI Safety Initiative — emerging.

Adjacent frameworks

  • ISO/IEC 27017 — cloud-specific extension of 27002.
  • ISO/IEC 27018 — PII in public clouds.
  • NIST SP 800-144 — cloud security and privacy.
  • CIS Cloud Benchmarks — prescriptive cloud configuration.
  • FedRAMP — US federal cloud.

STAR-registered cloud providers

Major providers: AWS, Microsoft Azure, Google Cloud, Salesforce, ServiceNow, Workday, Box, Dropbox, many others.

Reference resources

  • cloudsecurityalliance.org — CSA hub.
  • cloudsecurityalliance.org/star — STAR Registry.

See also