Framework

CSA Cloud Controls Matrix v4.0.1: what it anchors in a questionnaire

The cloud controls matrix behind the CAIQ. CAIQ question ids (IAM-02, DSP-07.1) resolve to their control; retired v3 domains are named as old numbering.

The text of this standard is not held in full here, so it is not quoted: each requirement carries a one-line statement of what it asks for, with its code and title, and the standard itself holds the wording. Ticked by default for software company and other customer customers.

Families anchored here

14 families, 14 clauses cited

Family	Clause
Background checks	HRS-01
Multi-factor authentication	IAM-14
Password policy	IAM-02
Encryption at rest	CEK-03
Encryption in transit	CEK-03
Data retention and secure deletion	DSP-16
Data location and transfers	DSP-19
Vulnerability and patch management	TVM-03
Incident response plan	SEF-03
Notifying the customer of an incident	SEF-07
Business continuity plan	BCR-04 · BCR-06
Backup and disaster recovery	BCR-08
Subcontractors and subprocessors	DSP-13
Data subject requests	DSP-11

Every CSA CCM clause the register cites, with its text and evidence