CSA CCM anchors

owner Stefan Coetzeecreated 2026-05-12updated 2026-05-12not reviewed1 min readreference

Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Primary documents

CSA Cloud Controls Matrix v4 — current.
Consensus Assessments Initiative Questionnaire (CAIQ) v4 — companion questionnaire.
CSA STAR Program documentation.

Operating body

Cloud Security Alliance — csa.org. Founded 2008.

Adjacent CSA work

CSA Top Threats reports (annual).
Egregious 11 / Pandemic 11 — top cloud security threats.
CSA AI Safety Initiative — emerging.

Adjacent frameworks

ISO/IEC 27017 — cloud-specific extension of 27002.
ISO/IEC 27018 — PII in public clouds.
NIST SP 800-144 — cloud security and privacy.
CIS Cloud Benchmarks — prescriptive cloud configuration.
FedRAMP — US federal cloud.

STAR-registered cloud providers

Major providers: AWS, Microsoft Azure, Google Cloud, Salesforce, ServiceNow, Workday, Box, Dropbox, many others.

Reference resources

cloudsecurityalliance.org — CSA hub.
cloudsecurityalliance.org/star — STAR Registry.