Control Requirements Mapped to the CSA Cloud Controls Matrix (CCM) v4.0

The following domain-based security architecture framework maps to the CSA Cloud Controls Matrix (CCM) v4.0 to identify the specific control requirements applicable to each architectural domain.

Framework Overview

Control family key:   AIS  Application & Interface Security   ·   CCC  Change Control & Configuration Management   ·   CEK  Cryptography, Encryption & Key Management   ·   DSP  Data Security & Privacy Lifecycle Management   ·   IAM  Identity & Access Management   ·   IVS  Infrastructure & Virtualization Security   ·   LOG  Logging & Monitoring   ·   UEM  Universal Endpoint Management

1.  Host Security

Build compliance must be verified against a baseline for all servers and end-user devices used to host and access the data. All approved security controls for the relevant host type must be implemented and configured to baseline. All known vulnerabilities must be detected and patched, or the associated risk remediated, before go-live. Security audit event logging must be enabled and configured so that it is monitored and alerted through the enterprise SIEM service.

2.  Infrastructure and Network Security

Network zoning and data flow policies must ensure that connectivity is only initiated from a higher trust zone to a lower trust zone, although data flow may be bi-directional once connectivity has been established. User and application access to data must originate only from trusted networks, segments, and devices, and must traverse the appropriate policy enforcement points. Production and non-production environments must be clearly segregated through policy enforcement points, and security controls must be identified and defined to minimise the risk of data loss from lower trust network environments.

3.  Application Security

Secure SDLC processes must be followed and verified for all applications that have access to this data. Supplier assurance, application reviews, and SAST and DAST processes must ensure that all known vulnerabilities are detected and patched, or the associated risk remediated, before go-live.

4.  Data Security

Information classification must be assigned and verified in line with policy. The controls for data handling defined by policy, covering auditing, access controls, encryption, data integrity assurance, and data privacy across the data lifecycle, must be verified before go-live. All data egress routes must be identified by threat modelling the system, and security controls must be identified and defined to prevent unauthorised access to, or loss of, production data.

5.  Identity and Access Management (I&AM)

Staff and customer IAM processes must be verified to ensure policy-based authentication and authorisation for all human users who have access to the data. Privileged access to infrastructure and applications by human users and service accounts that have access to data must be identified and managed through PAM controls.

6.  Solutions Architecture

High-level designs (HLDs) and low-level designs (LLDs) must be kept up to date with all changes to the solutions architecture, and must be reviewed through the appropriate governance and Service Introduction processes before go-live.