Frameworks / Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 / CCM-IVS-03 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
IVS - Infrastructure & Virtualization Security
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IVS-03: Network Security Restrict traffic between environments to authenticated and authorised connections, encrypt and monitor it, and review the configuration at least annually with a written justification for every allowed service, protocol, port and compensating control.
Maintained by Gerard Blokdyk · Control text last updated 19 August 2026 What else in your programme already covers this This control maps to 111 controls across 29 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
AC-17 Remote Access AC-17(1) Monitoring and Control AC-17(3) Managed Access Control Points AC-20 Use of External Systems AC-4 Information Flow Enforcement CA-9 Internal System Connections SC-23 Session Authenticity SC-7 Boundary Protection SC-7(3) Access Points SC-7(4) External Telecommunications Services SC-7(5) Deny by Default Allow by Exception SC-7(8) Route Traffic to Authenticated Proxy Servers AC-17 Remote Access AC-17(1) Monitoring and Control AC-17(3) Managed Access Control Points AC-20 Use of External Systems AC-4 Information Flow Enforcement CA-9 Internal System Connections SC-23 Session Authenticity SC-7 Boundary Protection SC-7(3) Access Points SC-7(4) External Telecommunications Services SC-7(5) Deny by Default Allow by Exception SC-7(8) Route Traffic to Authenticated Proxy Servers 1.2.1 1.2.1 Ruleset configuration standards for NSCs 1.2.7 1.2.7 Six-monthly review of NSC configurations 1.3.1 1.3.1 Inbound CDE traffic restricted 1.3.2 1.3.2 Outbound CDE traffic restricted 1.4.1 1.4.1 NSCs between trusted and untrusted networks 1.4.2 1.4.2 Restricting traffic entering trusted networks from outside 1.4.5 1.4.5 Internal IP and routing disclosure limited 2.2.7 2.2.7 Non-console administrative access encrypted ANSSI-HYG-19 Segment the Network and Partition the Zones ANSSI-HYG-20 Secure Wi-Fi Access Networks and Separate Usage ANSSI-HYG-21 Use Secure Protocols Wherever They Exist ANSSI-HYG-22 Put in Place a Secure Internet Access Gateway ANSSI-HYG-25 Secure Dedicated Network Interconnections with Partners ANSSI-HYG-27 Prohibit Internet Access from Administration Workstations and Servers ASBv3-NS-7 Simplify network security configuration ASBv3-NS-8 Detect and disable insecure services and protocols NS-1 Establish network segmentation boundaries NS-2 Secure cloud services with network controls NS-3 Deploy firewall at the edge of enterprise network CIS-12.2 Establish and Maintain a Secure Network Architecture CIS-12.3 Securely Manage Network Infrastructure CIS-12.6 Use of Secure Network Management and Communication Protocols CIS-13.4 Perform Traffic Filtering Between Network Segments CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure CE-FW.1 Boundary Firewalls Deployed CE-FW.3 Block Unauthenticated Inbound Connections CE-FW.4 Approve and Document Inbound Rules CE-FW.5 Remove or Disable Unused Rules CE-FW.7 Restrict Firewall Administrative Interface from the Internet ASD37-08 Deny direct internet connectivity (Excellent) ASD37-22 Network segmentation (Excellent) ASD37-32 Network-based IDS/IPS (Limited) C5-COS-01 Technical safeguards C5-COS-02 Security requirements for connections in the Cloud Service Provider's network C5-COS-03 Monitoring of connections in the Cloud Service Provider's network 3.11.4e Security Solution Rationale Document 3.13.1e Create Diversity in System Components to Limit Malicious Code Propagation 3.5.1e Identification of Systems, Components, and Devices 8.20 Networks security 8.21 Security of network services 8.20 Networks security 8.21 Security of network services 6.10.1 Network security management 6.6.1 Business requirements of access control SOC2-CC6.1 CC6.1 Logical access security over protected information assets SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary AUCDR-IS-2 Secure the network and systems within the data environment 13.1 Network security management 13.1 Network security management NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in IVS - Infrastructure & Virtualization Security You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done? Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IVS-03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 111 it maps to, and the evidence behind each claim, over MCP and REST.