CSA CCM v4.0.1: the evidence behind every control

197 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

A&A - Audit & Assurance

A&A-01Audit and Assurance Policy and Procedures hard A&A-02Independent Assessments hard A&A-03Risk Based Planning Assessment hard A&A-04Requirements Compliance hard A&A-05Audit Management Process hard A&A-06Remediation hard

AIS - Application & Interface Security

AIS-01Application and Interface Security Policy and Procedures hard AIS-02Application Security Baseline Requirements hard AIS-03Application Security Metrics moderate AIS-04Secure Application Design and Development moderate AIS-05Automated Application Security Testing moderate AIS-06Automated Secure Application Deployment moderate AIS-07Application Vulnerability Remediation moderate

BCR - Business Continuity Management & Operational Resilience

BCR-01Business Continuity Management Policy and Procedures hard BCR-02Risk Assessment and Impact Analysis hard BCR-03Business Continuity Strategy hard BCR-04Business Continuity Planning hard BCR-05Documentation hard BCR-06Business Continuity Exercises hard BCR-07Communication hard BCR-08Backup moderate BCR-09Disaster Response Plan hard BCR-10Response Plan Exercise hard BCR-11Equipment Redundancy moderate

CCC - Change Control & Configuration Management

CCC-01Change Management Policy and Procedures hard CCC-02Quality Testing moderate CCC-03Change Management Technology hard CCC-04Unauthorized Change Protection moderate CCC-05Change Agreements hard CCC-06Change Management Baseline hard CCC-07Detection of Baseline Deviation easy CCC-08Exception Management hard CCC-09Change Restoration hard

CEK - Cryptography, Encryption & Key Management

DCS - Datacenter Security

DCS-01Off-Site Equipment Disposal Policy and Procedures hard DCS-02Off-Site Transfer Authorization Policy and Procedures hard DCS-03Secure Area Policy and Procedures hard DCS-04Secure Media Transportation Policy and Procedures hard DCS-05Assets Classification hard DCS-06Assets Cataloguing and Tracking hard DCS-07Controlled Access Points hard DCS-08Equipment Identification moderate DCS-09Secure Area Authorization easy DCS-10Surveillance System easy DCS-11Unauthorized Access Response Training hard DCS-12Cabling Security hard DCS-13Environmental Systems easy DCS-14Secure Utilities moderate DCS-15Equipment Location hard

DSP - Data Security & Privacy Lifecycle Management

DSP-01Security and Privacy Policy and Procedures hard DSP-02Secure Disposal hard DSP-03Data Inventory hard DSP-04Data Classification hard DSP-05Data Flow Documentation hard DSP-06Data Ownership and Stewardship hard DSP-07Data Protection by Design and Default hard DSP-08Data Privacy by Design and Default easy DSP-09Data Protection Impact Assessment hard DSP-10Sensitive Data Transfer hard DSP-11Personal Data Access, Reversal, Rectification and Deletion moderate DSP-12Limitation of Purpose in Personal Data Processing hard DSP-13Personal Data Sub-processing hard DSP-14Disclosure of Data Sub-processors hard DSP-15Limitation of Production Data Use moderate DSP-16Data Retention and Deletion hard DSP-17Sensitive Data Protection hard DSP-18Disclosure Notification hard DSP-19Data Location hard

GRC - Governance, Risk & Compliance

GRC-01Governance Program Policy and Procedures hard GRC-02Risk Management Program hard GRC-03Organizational Policy Reviews hard GRC-04Policy Exception Process hard GRC-05Information Security Program hard GRC-06Governance Responsibility Model hard GRC-07Information System Regulatory Mapping hard GRC-08Special Interest Groups hard

HRS - Human Resources Security

HRS-01Background Screening Policy and Procedures hard HRS-02Acceptable Use of Technology Policy and Procedures moderate HRS-03Clean Desk Policy and Procedures hard HRS-04Remote and Home Working Policy and Procedures hard HRS-05Asset returns easy HRS-06Employment Termination hard HRS-07Employment Agreement Process hard HRS-08Employment Agreement Content hard HRS-09Personnel Roles and Responsibilities hard HRS-10Non-Disclosure Agreements hard HRS-11Security Awareness Training hard HRS-12Personal and Sensitive Data Awareness and Training hard HRS-13Compliance User Responsibility hard

IAM - Identity & Access Management

IAM-01Identity and Access Management Policy and Procedures hard IAM-02Strong Password Policy and Procedures hard IAM-03Identity Inventory hard IAM-04Separation of Duties hard IAM-05Least Privilege hard IAM-06User Access Provisioning moderate IAM-07User Access Changes and Revocation moderate IAM-08User Access Review hard IAM-09Segregation of Privileged Access Roles hard IAM-10Management of Privileged Access Roles hard IAM-11CSCs Approval for Agreed Privileged Access Roles hard IAM-12Safeguard Logs Integrity easy IAM-13Uniquely Identifiable Users hard IAM-14Strong Authentication moderate IAM-15Passwords Management hard IAM-16Authorization Mechanisms hard

IPY - Interoperability & Portability

IPY-01Interoperability and Portability Policy and Procedures hard IPY-02Application Interface Availability hard IPY-03Secure Interoperability and Portability Management easy IPY-04Data Portability Contractual Obligations hard

IVS - Infrastructure & Virtualization Security

IVS-01Infrastructure and Virtualization Security Policy and Procedures hard IVS-02Capacity and Resource Planning moderate IVS-03Network Security moderate IVS-04OS Hardening and Base Controls moderate IVS-05Production and Non-Production Environments hard IVS-06Segmentation and Segregation moderate IVS-07Migration to Cloud Environments hard IVS-08Network Architecture Documentation hard IVS-09Network Defense easy

LOG - Logging & Monitoring

LOG-01Logging and Monitoring Policy and Procedures hard LOG-02Audit Logs Protection easy LOG-03Security Monitoring and Alerting easy LOG-04Audit Logs Access and Accountability easy LOG-05Audit Logs Monitoring and Response hard LOG-06Clock Synchronization easy LOG-07Logging Scope easy LOG-08Log Records easy LOG-09Log Protection hard LOG-10Encryption Monitoring and Reporting easy LOG-11Transaction/Activity Logging easy LOG-12Access Control Logs moderate LOG-13Failures and Anomalies Reporting easy

SEF - Security Incident Management, E-Discovery & Cloud Forensics

SEF-01Security Incident Management Policy and Procedures hard SEF-02Service Management Policy and Procedures hard SEF-03Incident Response Plans hard SEF-04Incident Response Testing hard SEF-05Incident Response Metrics moderate SEF-06Event Triage Processes hard SEF-07Security Breach Notification hard SEF-08Points of Contact Maintenance hard

STA - Supply Chain Management, Transparency & Accountability

STA-01SSRM Policy and Procedures hard STA-02SSRM Supply Chain hard STA-03SSRM Guidance hard STA-04SSRM Control Ownership hard STA-05SSRM Documentation Review hard STA-06SSRM Control Implementation moderate STA-07Supply Chain Inventory hard STA-08Supply Chain Risk Management hard STA-09Primary Service and Contractual Agreement hard STA-10Supply Chain Agreement Review hard STA-11Internal Compliance Testing hard STA-12Supply Chain Service Agreement Compliance hard STA-13Supply Chain Governance Review hard STA-14Supply Chain Data Security Assessment hard

TVM - Threat & Vulnerability Management

TVM-01Threat and Vulnerability Management Policy and Procedures hard TVM-02Malware Protection Policy and Procedures hard TVM-03Vulnerability Remediation Schedule hard TVM-04Detection Updates easy TVM-05External Library Vulnerabilities moderate TVM-06Penetration Testing hard TVM-07Vulnerability Identification easy TVM-08Vulnerability Prioritization hard TVM-09Vulnerability Management Reporting hard TVM-10Vulnerability Management Metrics hard

UEM - Universal Endpoint Management

UEM-01Endpoint Devices Policy and Procedures hard UEM-02Application and Service Approval moderate UEM-03Compatibility hard UEM-04Endpoint Inventory hard UEM-05Endpoint Management hard UEM-06Automatic Lock Screen moderate UEM-07Operating Systems hard UEM-08Storage Encryption hard UEM-09Anti-Malware Detection and Prevention moderate UEM-10Software Firewall moderate UEM-11Data Loss Prevention hard UEM-12Remote Locate moderate UEM-13Remote Wipe hard UEM-14Third-Party Endpoint Security Posture hard