Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1

CSA CCM v4.1 (matrix release 4.1.1), the cloud control framework of the Cloud Security Alliance: 207 control objectives in 17 domains (audit and assurance, application and interface security, business continuity and operational resilience, change control and configuration, cryptography and key management, datacenter security, data security and privacy lifecycle, governance risk and compliance, human resources, identity and access management, interoperability and portability, infrastructure security, logging and monitoring, incident management and cloud forensics, supply chain management, threat and vulnerability management, universal endpoint management), the control set behind CSA STAR Level 1 self-assessment (CAIQ v4.1, 283 questions) and Level 2 certification and attestation. What changed from v4.0.1: eleven controls added (AIS-08 API security; DCS-01 physical and environmental security policy, DCS-17 datacenter metrics, DCS-18 datacenter operations resilience; LOG-08 sanitising sensitive data in logs; SEF-07 incident response by category and severity, SEF-09 incident records repository and trend review; STA-01 supply chain risk management policy, STA-09 service bill of materials; TVM-04 threat analysis and modelling, TVM-10 risk-based threat response); one removed (v4.0.1 IAM-12, safeguarding log integrity); Infrastructure and Virtualization Security (IVS) renamed Infrastructure Security (I&S); controls renumbered in DCS, IAM, LOG, SEF, STA and TVM; policy reviews now also triggered by significant change; supply chain controls reworded from cloud provider and customer to service provider and customer. Matrix 4.1.1 (October 2026) adds NIST SP 800-171 rev2, MITRE ATT&CK and DORA mappings and corrects two typographic errors. CSA keeps v4.0.x acceptable for STAR during its transition period.