CSA CCM v4.1: the evidence behind each requirement

207 control objectives. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Version 4.1 adds 11 controls (among them API security, log sanitisation and a service bill of materials) and renumbers several domains. CSA accepts v4.0.x during its transition; if your STAR assessment is still on v4.0.1, check the numbering against it.

A&A - Audit & Assurance

A&A-01Audit and Assurance Policy and Procedures hard A&A-02Independent Assessments hard A&A-03Risk Based Planning Assessment hard A&A-04Requirements Compliance hard A&A-05Audit Management Process hard A&A-06Remediation hard

AIS - Application & Interface Security

AIS-01Application and Interface Security Policy and Procedures hard AIS-02Application Security Baseline Requirements hard AIS-03Application Security Metrics hard AIS-04Secure Application Development Lifecycle hard AIS-05Application Security Testing moderate AIS-06Secure Application Deployment moderate AIS-07Application Vulnerability Remediation easy AIS-08API Security moderate

BCR - Business Continuity Management and Operational Resilience

BCR-01Business Continuity Management Policy and Procedures moderate BCR-02Risk Assessment and Impact Analysis hard BCR-03Business Continuity Strategy hard BCR-04Business Continuity Planning moderate BCR-05Documentation hard BCR-06Business Continuity Exercises moderate BCR-07Communication hard BCR-08Backup easy BCR-09Disaster Response Plan moderate BCR-10Response Plan Exercise hard BCR-11Equipment Redundancy hard

CCC - Change Control and Configuration Management

CCC-01Change Management Policy and Procedures easy CCC-02Quality Testing moderate CCC-03Change Management Technology easy CCC-04Unauthorized Change Protection moderate CCC-05Change Agreements moderate CCC-06Change Management Baseline easy CCC-07Detection of Baseline Deviation easy CCC-08Exception Management moderate CCC-09Change Restoration hard

CEK - Cryptography, Encryption & Key Management

DCS - Datacenter Security

DCS-01Physical and Environmental Security Policy and Procedures hard DCS-02Off-Site Equipment Disposal Policy and Procedures hard DCS-03Off-Site Transfer Authorization Policy and Procedures hard DCS-04Secure Area Policy and Procedures hard DCS-05Secure Media Transportation Policy and Procedures moderate DCS-06Assets Classification hard DCS-07Assets Cataloguing and Tracking moderate DCS-08Controlled Physical Access Points hard DCS-09Equipment Identification easy DCS-10Secure Area Authorization moderate DCS-11Surveillance System moderate DCS-12Adverse Event Response Training hard DCS-13Cabling Security hard DCS-14Environmental Systems hard DCS-15Secure Utilities hard DCS-16Equipment Location hard DCS-17Datacenter Metrics hard DCS-18Datacenter Operations Resilience hard

DSP - Data Security and Privacy Lifecycle Management

DSP-01Security and Privacy Policy and Procedures hard DSP-02Secure Disposal hard DSP-03Data Inventory hard DSP-04Data Classification hard DSP-05Data Flow Documentation hard DSP-06Data Ownership and Stewardship hard DSP-07Data Protection by Design and Default hard DSP-08Data Privacy by Design and Default moderate DSP-09Data Protection Impact Assessment hard DSP-10Sensitive Data Transfer hard DSP-11Personal Data Access, Reversal, Rectification and Deletion hard DSP-12Limitation of Purpose in Personal Data Processing hard DSP-13Personal Data Sub-processing hard DSP-14Disclosure of Data Sub-processors hard DSP-15Limitation of Production Data Use hard DSP-16Data Retention and Deletion hard DSP-17Sensitive Data Protection moderate DSP-18Disclosure Notification hard DSP-19Data Location moderate

GRC - Governance, Risk and Compliance

GRC-01Governance Program Policy and Procedures hard GRC-02Risk Management Program hard GRC-03Organizational Policy Reviews moderate GRC-04Policy Exception Process hard GRC-05Information Security Program hard GRC-06Governance Responsibility Model hard GRC-07Information System Regulatory Mapping hard GRC-08Special Interest Groups hard

HRS - Human Resources

HRS-01Background Screening Policy and Procedures easy HRS-02Acceptable Use of Technology Policy and Procedures hard HRS-03Clean Desk Policy and Procedures hard HRS-04Remote and Home Working Policy and Procedures hard HRS-05Asset returns hard HRS-06Employment Termination moderate HRS-07Employment Agreement Process hard HRS-08Employment Agreement Content hard HRS-09Personnel Roles and Responsibilities hard HRS-10Non-Disclosure Agreements hard HRS-11Security Awareness Training hard HRS-12Personal and Sensitive Data Awareness and Training hard HRS-13Compliance User Responsibility moderate

I&S - Infrastructure Security

I&S-01Infrastructure and Virtualization Security Policy and Procedures hard I&S-02Capacity and Resource Planning easy I&S-03Network Security moderate I&S-04OS Hardening and Base Controls easy I&S-05Production and Non-Production Environments hard I&S-06Segmentation and Segregation easy I&S-07Migration to Cloud Environments moderate I&S-08Network Architecture Documentation hard I&S-09Network Defense moderate

IAM - Identity & Access Management

IAM-01Identity and Access Management Policy and Procedures hard IAM-02Credentials Management Policy and Procedures hard IAM-03Identity Inventory easy IAM-04Separation of Duties hard IAM-05Least Privilege hard IAM-06Access Provisioning hard IAM-07Access Changes and Revocation moderate IAM-08Access Review hard IAM-09Segregation of Privileged Access Roles moderate IAM-10Management of Privileged Access Roles moderate IAM-11Service Customers Approval for Agreed Privileged Access Roles hard IAM-12Unique Identities hard IAM-13Strong Authentication easy IAM-14Credentials Management moderate IAM-15Authorization Mechanisms moderate

IPY - Interoperability & Portability

IPY-01Interoperability and Portability Policy and Procedures moderate IPY-02Application Interface Availability moderate IPY-03Secure Interoperability and Portability Management easy IPY-04Data Portability Contractual Obligations hard

LOG - Logging and Monitoring

LOG-01Logging and Monitoring Policy and Procedures hard LOG-02Audit Logs Protection easy LOG-03Security Monitoring and Alerting easy LOG-04Audit Logs Access and Accountability moderate LOG-05Audit Logs Monitoring and Response easy LOG-06Clock Synchronization easy LOG-07Logging Scope hard LOG-08Audit Logs Sanitization moderate LOG-09Log Records moderate LOG-10Audit Records Protection easy LOG-11Encryption Monitoring and Reporting moderate LOG-12Transaction/Activity Logging easy LOG-13Access Control Logs easy LOG-14Failures and Anomalies Reporting moderate

SEF - Security Incident Management, E-Discovery, & Cloud Forensics

SEF-01Security Incident Management Policy and Procedures hard SEF-02Service Management Policy and Procedures hard SEF-03Incident Response Plans hard SEF-04Incident Response Testing hard SEF-05Incident Response Metrics moderate SEF-06Event Triage Processes hard SEF-07Incident Management and Response hard SEF-08Security Breach Notification hard SEF-09Incident Records Management moderate SEF-10Points of Contact Maintenance hard

STA - Supply Chain Management, Transparency, and Accountability

STA-01Supply Chain Risk Management Policies and Procedures hard STA-02SSRM Policy and Procedures hard STA-03SSRM Supply Chain hard STA-04SSRM Guidance moderate STA-05SSRM Control Ownership hard STA-06SSRM Documentation Review moderate STA-07SSRM Control Implementation moderate STA-08Supply Chain Inventory hard STA-09Service Bill of Material (BOM) hard STA-10Supply Chain Risk Management hard STA-11Primary Service and Contractual Agreement hard STA-12Supply Chain Agreement Review moderate STA-13Supply Chain Compliance Assessment moderate STA-14Supply Chain Service Agreement Compliance hard STA-15Supply Chain Governance Review hard STA-16Supply Chain Data Security Assessment hard

TVM - Threat & Vulnerability Management

TVM-01Threat and Vulnerability Management Policy and Procedures hard TVM-02Malware and Malicious Instructions Protection Policy and Procedures hard TVM-03Vulnerability Identification moderate TVM-04Threat Analysis and Modelling moderate TVM-05Detection Updates easy TVM-06External Library Vulnerabilities moderate TVM-07Penetration Testing hard TVM-08Vulnerability Remediation Schedule easy TVM-09Vulnerability Prioritization hard TVM-10Threat Response hard TVM-11Vulnerability Management Reporting easy TVM-12Vulnerability Management Metrics moderate

UEM - Universal Endpoint Management

UEM-01Endpoint Devices Policy and Procedures hard UEM-02Application and Service Approval moderate UEM-03Compatibility hard UEM-04Endpoint Inventory moderate UEM-05Endpoint Management easy UEM-06Automatic Lock Screen easy UEM-07Operating Systems easy UEM-08Storage Encryption easy UEM-09Anti-Malware Detection and Prevention easy UEM-10Software Firewall easy UEM-11Data Loss Prevention easy UEM-12Remote Locate moderate UEM-13Remote Wipe moderate UEM-14Third-Party Endpoint Security Posture hard