Cloud Controls Matrix (CCM) is the Cloud Security Alliance's catalog of 197 security and privacy controls mapped specifically to cloud infrastructure, platform, and SaaS environments. It organizes controls across 17 domains including identity, encryption, business continuity, and supply-chain management.
The current v4 forms the basis for the CAIQ questionnaire and the CSA STAR certification program. Teams use CCM as both an audit checklist and a reference architecture for cloud security control design.