TheArtOfService
NIST SP 800-53 Rev 5Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

NIST SP 800-53 Rev 5 covers 71.1% of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

140 of the 197 controls in Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 are already satisfied by evidence you collected for NIST SP 800-53 Rev 5. 57 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

71.1%
of the target already covered
140
controls evidenced
57
genuine gaps
8
claims rejected in review

This number is directional. It says how much of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 your NIST SP 800-53 Rev 5 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

248 candidate mappings were examined and 12 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair. This pair was additionally re-checked after CSA CCM v4.0.1 was rebuilt from the CAIQ v4.0.1 source on 2026-08-19: its mappings were originally judged when CCM carried no requirement text, a sample of 70 across the 21 CCM pairs found about 80 percent holding cleanly, and the two identified errors were corrected before release.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

CCC - Change Control & Configuration Management8 of 9 evidenced, 1 to do
IVS - Infrastructure & Virtualization Security8 of 9 evidenced, 1 to do
DCS - Datacenter Security13 of 15 evidenced, 2 to do
AIS - Application & Interface Security6 of 7 evidenced, 1 to do
HRS - Human Resources Security11 of 13 evidenced, 2 to do
LOG - Logging & Monitoring11 of 13 evidenced, 2 to do
IAM - Identity & Access Management13 of 16 evidenced, 3 to do
TVM - Threat & Vulnerability Management8 of 10 evidenced, 2 to do
DSP - Data Security & Privacy Lifecycle Management15 of 19 evidenced, 4 to do
SEF - Security Incident Management, E-Discovery & Cloud Forensics6 of 8 evidenced, 2 to do
BCR - Business Continuity Management & Operational Resilience8 of 11 evidenced, 3 to do
A&A - Audit & Assurance4 of 6 evidenced, 2 to do
UEM - Universal Endpoint Management9 of 14 evidenced, 5 to do
GRC - Governance, Risk & Compliance5 of 8 evidenced, 3 to do
STA - Supply Chain Management, Transparency & Accountability8 of 14 evidenced, 6 to do
CEK - Cryptography, Encryption & Key Management6 of 21 evidenced, 15 to do
IPY - Interoperability & Portability1 of 4 evidenced, 3 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

NIST800-CA-1CCM-A&A-01argued against and upheld
Audit and Assurance Policy and Procedures

CA-1 requires documented assessment, authorization and monitoring policy and procedures.

NIST800-CA-2CCM-A&A-02argued against and upheld
Independent Assessments

CA-2 requires assessors with the required level of independence.

NIST800-CA-2CCM-A&A-05argued against and upheld
Audit Management Process

CA-2 requires a documented assessment plan covering scope, procedures and reporting.

NIST800-CA-5CCM-A&A-06argued against and upheld
Remediation

CA-5 requires a plan of action and milestones to remediate assessment findings.

NIST800-SA-1CCM-AIS-01argued against and upheld
Application and Interface Security Policy and Procedures

SA-1 requires documented system and services acquisition policy covering application security.

NIST800-SA-4CCM-AIS-02argued against and upheld
Application Security Baseline Requirements

SA-4 requires security requirements be defined and included for acquired systems and components.

NIST800-PM-6CCM-AIS-03argued against and upheld
Application Security Metrics

PM-6 requires developing, monitoring and reporting security measures of performance.

NIST800-SA-8CCM-AIS-04argued against and upheld
Secure Application Design and Development

SA-8 requires applying security and privacy engineering principles in design and development.

Claims that did not hold

8 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

NIST800-CM-3CCM-CCC-01
Change Management Policy and Procedures

Not corroborated on review of this pair by Claude Code

NIST800-SC-12CCM-CEK-01
Encryption and Key Management Policy and Procedures

Not corroborated on review of this pair by Claude Code

NIST800-AU-2CCM-LOG-01
Logging and Monitoring Policy and Procedures

Not corroborated on review of this pair by Claude Code

NIST800-AU-11CCM-LOG-09
Log Protection

re-pointed 2026-08-19: judged when CCM carried no requirement text, so it landed on the control whose title resembled the requirement rather than the control that carries it

Claimed at high confidence before it was rejected.

NIST800-IR-4CCM-SEF-03
Incident Response Plans

Not corroborated on review of this pair by Claude Code

NIST800-SR-3CCM-STA-08
Supply Chain Risk Management

Not corroborated on review of this pair by Claude Code

NIST800-RA-5CCM-TVM-01
Threat and Vulnerability Management Policy and Procedures

Not corroborated on review of this pair by Claude Code

NIST800-CM-8CCM-UEM-01
Endpoint Devices Policy and Procedures

Not corroborated on review of this pair by Claude Code

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk