CSA CCM with ISMS
Overview of CSA CCM mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.
CSA CCM v4 domains organized by their mapping to the Kudo domains and mapped to the ISMS policies.
COR — Organizational Coherence
🛡️ Information Security Policy
GRC-01, GRC-02, GRC-03 — Security governance and policy management.
⚠️ Risk Management Policy
GRC-04, GRC-05 — Cloud risk assessment and treatment.
⚖️ Compliance Management Policy
GRC-06, GRC-07, A&A-01–A&A-08 — Regulatory compliance and continuous auditing.
📄 Documents and Records Policy
A&A-05, A&A-06 — Audit documentation and compliance evidence.
CIP — Identity and Endpoints
🔑 Access Management Policy
IAM-01–IAM-14 — Identity management, authentication and access control in the cloud.
🔒 Hardening Policy
UEM-01–UEM-13 — Secure management and configuration of universal endpoints.
CIF — Infrastructure Cybersecurity
🏢 Physical Security Policy
DCS-01–DCS-06 — Physical security of data centers and facility access.
💻 IT Security Policy
DCS-07–DCS-12, IVS-01–IVS-05 — Logical security of data centers and virtualization.
📡 Communications Security Policy
IVS-06–IVS-10, CEK-01–CEK-21 — Network security, cryptography and key management.
☁️ Cloud Services Policy
IPY-01–IPY-03 — Interoperability and portability between cloud providers.
CAP — Application Cybersecurity
CCN — Business Continuity and Change
🛟 Business Continuity Policy
BCR-01–BCR-12 — Operational continuity and resilience in cloud environments.
🛠️ Change and Configuration Management Policy
CCC-01–CCC-10 — Change control and configuration management in the cloud.
THP — Human Talent and Vendors
👥 Human Resources Security Policy
HRS-01–HRS-10, HRS-13 — Employee lifecycle and personnel security.
🎓 Awareness Management Policy
HRS-11–HRS-12 — Cloud security training and awareness.
🤝 Vendor Management Policy
STA-01–STA-10 — Supply chain, transparency and vendor accountability.
DIA — Data and Artificial Intelligence
🛡️ Privacy Policy
DSP-01–DSP-23 — Data security and privacy lifecycle in the cloud.
📦 Asset Management Policy
DSP-01–DSP-05 — Inventory and classification of data assets in the cloud.
ADR — Analysis, Detection and Response
📊 Logging and Monitoring Policy
LOG-01–LOG-13 — Logging, monitoring and event traceability in the cloud.
🚨 Incident Management Policy
SEF-01–SEF-09 — Security incident management, e-discovery and forensic analysis.
🔒 Hardening Policy
TVM-01–TVM-11 — Threat and vulnerability management in cloud infrastructure.