Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-STA-11: Internal Compliance Testing

What else in your programme already covers this

This control maps to 51 controls across 28 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 4 controls

NIST800-CA-2 CA-2 Control Assessments
NIST800-CA-7 CA-7 Continuous Monitoring
NIST800-PM-14 PM-14 Testing, Training, and Monitoring
NIST800-PM-31 PM-31 Continuous Monitoring Strategy

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-47 Monitoring and Senior Management Reporting on Material Arrangements
CPS230-66 Review of Operational Risk Management
CPS230-P30 Monitoring, Review and Testing of Control Effectiveness

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established

APRA CPS 220 Risk Management · 2 controls

CPS220-11 Annual Audit Review of the Framework
CPS220-P47 Minimum Assessment Required by the Framework Review

APRA CPS 234 · 2 controls

CPS234-22 Systematic Control Testing Program
CPS234-25 Internal Audit Review of Information Security Controls

Azure Security Benchmark · 2 controls

ASBv3-PV-7 Conduct regular red team operations
PV-2 Audit and enforce secure configurations

C5 (Germany) · 2 controls

C5-COM-03 Internal audits of the information security management system
C5-SSO-04 Monitoring of compliance with requirements

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-15 Controls Testing
CFTC-SS-33 Regular Periodic Objective Testing and Review of Automated Systems

CMMC 2.0 · 2 controls

CA.L2-3.12.1 Security Control Assessment
CA.L2-3.12.3 Security Control Monitoring

DORA · 2 controls

DORA-Art.50 Administrative penalties and remedial measures
DORA-Art.6 ICT risk management framework

FedRAMP High · 2 controls

CA-2 Control Assessments
CA-7 Continuous Monitoring

FedRAMP Moderate · 2 controls

CA-2 Control Assessments
CA-7 Continuous Monitoring

ISO 22301:2019 · 2 controls

9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit

ISO 27001:2022 · 2 controls

5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security

ISO 27002:2022 · 2 controls

5.35 Independent review of information security
5.36 Compliance with policies, rules and standards for information security

ISO 27701:2019 · 2 controls

5.7.1 Monitoring, measurement, analysis and evaluation
5.7.2 Internal audit

NIST SP 800-161 Rev 1 · 2 controls

161R1-CA-7 Continuous Monitoring
161R1-PM-14 Testing, Training, and Monitoring

NIST SP 800-171 Rev 3 · 2 controls

03.12.01 Security Assessment
03.12.03 Continuous Monitoring

PCI DSS 4.0 · 2 controls

12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews

AWS Well-Architected Security Pillar · 1 control

SEC01-BP03 Identify and validate control objectives

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

EU AI Act · 1 control

EUAI-Art.43 Conformity assessment

HIPAA Security Rule · 1 control

164.308(a)(8) Evaluation (Standard)

NIS2 Directive · 1 control

Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 1 control

171A-03.12.01 Security Assessment

NIST SP 800-172 · 1 control

3.11.5e Assess Effectiveness of Security Solutions

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(8) Evaluation (Standard)

SOC 2 · 1 control

SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 have you already done?

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 CCM-STA-11 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 140 of 197 Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 controls already carry evidence.

If you hold NIST SP 800-53 Rev 571.1% covered · 57 gaps If you hold FedRAMP Moderate60.4% covered · 78 gaps If you hold PCI DSS 4.060.4% covered · 78 gaps If you hold C5 (Germany)58.4% covered · 82 gaps If you hold ISO 27001:202256.3% covered · 86 gaps If you hold ISO 27002:202256.3% covered · 86 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 12 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 each Browse the graph free