Frameworks / Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 / CCM-IVS-09 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
IVS - Infrastructure & Virtualization Security
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IVS-09: Network Defense Apply defence in depth against network attack, covering prevention, detection and timely response, through defined and evaluated processes.
Maintained by Gerard Blokdyk · Control text last updated 19 August 2026 What else in your programme already covers this This control maps to 64 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ASD37-07 Web content filtering (Excellent) ASD37-08 Deny direct internet connectivity (Excellent) ASD37-25 Software firewall - inbound (Very Good) ASD37-28 Continuous incident detection and response (Excellent) ASD37-29 Host-based IDS/IPS (Very Good) ASD37-32 Network-based IDS/IPS (Limited) SC-5 Denial-of-Service Protection SC-7 Boundary Protection SI-4 System Monitoring SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1)) SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(4) Inbound and Outbound Communications Traffic SC-5 Denial-of-Service Protection SC-7 Boundary Protection SI-4 System Monitoring SI-4(1) System Monitoring | System-wide Intrusion Detection System (SI-4(1)) SI-4(18) System Monitoring | Analyze Traffic and Covert Exfiltration (SI-4(18)) SI-4(4) Inbound and Outbound Communications Traffic ASBv3-NS-4 Deploy intrusion detection/intrusion prevention systems (IDS/IPS) ASBv3-NS-6 Deploy web application firewall NS-3 Deploy firewall at the edge of enterprise network NS-5 Deploy DDOS protection CIS-13.10 Perform Application Layer Filtering CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS-4.4 Implement and Manage a Firewall on Servers 1.4.3 1.4.3 Anti-spoofing measures at trusted boundary 11.5.1 11.5.1 IDS/IPS monitoring of CDE traffic 11.5.1.1 11.5.1.1 Service providers detect covert malware channels 6.4.2 6.4.2 Automated web attack detection and prevention C5-COS-01 Technical safeguards C5-COS-03 Monitoring of connections in the Cloud Service Provider's network C5-COS-04 Cross-network access ANSSI-HYG-17 Enable and Configure the Local Firewall on Workstations ANSSI-HYG-22 Put in Place a Secure Internet Access Gateway SEC05-BP02 Control traffic flow within your network layers SEC05-BP03 Implement inspection-based protection 8.16 Monitoring activities 8.20 Networks security 8.16 Monitoring activities 8.20 Networks security NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage 3.11.2e Threat Hunting 3.14.2e Monitor Organizational Systems with Specialized Capabilities SOC2-CC6.6 CC6.6 Protection against threats from outside the system boundary SOC2-CC7.2 CC7.2 Monitoring system components for anomalies CBPR-PR-32 Detection, prevention and response measures CPS234-30 Detection and Response Mechanisms AUCDR-IS-2 Secure the network and systems within the data environment 6.10.1 Network security management CE-FW.1 Boundary Firewalls Deployed Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in IVS - Infrastructure & Virtualization Security You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done? Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-IVS-09 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 64 it maps to, and the evidence behind each claim, over MCP and REST.