CSA STAR Certification Cloud Control Matrix V4 transition requirements

65% of global GDP will be digitized by 2022 according to IDC market forecast, and cloud computing continues to have a big role to play1. So, it’s essential that the established CSA STAR Certification programme continues to evolve and remain relevant to the challenges of today.

This means the Cloud Control Matrix (CCM) has been updated and transition requirements have been set to support certified organizations to benefit from a more relevant framework that supports their cloud security provisions.

Introducing Cloud Control Matrix V4

Recently updated, the CCM V4 responds to the changing marketplace. The Cloud Security Alliance (CSA) want to offer to the community the best vendor agnostic cloud security and privacy control framework in market.

This update raises the bar on cloud security, focusing on ensuring:

  • requirements cover new cloud technologies
  • an improved audit programme that supports all parties
  • clarity of cloud security responsibilities
  • improved compatibility with other standards2.

What are the main changes to CCM V4?

CCM V4 now has 17 domains and 197 controls. The main changes include:

  • New domain introduced on logging and monitoring
  • New controls have been introduced, such as application security metrics
  • Some existing controls have been partially updated. For example, audit and assurance policies and procedures now specifies that organizations must "review and update the policies and procedures at least annually."
See a summary table of the key changes here >

What does this mean for my CSA STAR Certification?

For your BSI certification to remain active, you'll need to transition to the new CCM V4. We will review your cloud security provisions against the new CCM controls to ensure you meet the new requirements. This can be done as a one-off transition visit or as an extension to your existing audit programme.

What are the CSA STAR transition timelines?

All certified organizations must transition to the new CCM V4 by 1 January 2023. Any new certification submissions from December 2021 will be against CCM V4.

Please note, following a successful transition with BSI you must submit the updated CAIQ v4 (supporting questionnaire) directly to the CSA to ensure the registry is updated.