DivisionCero
CSA CCM and Kudo

CSA CCM Controls with ISMS

Control-by-control mapping between CSA CCM and the Kudo ISMS, with the complete structure ready for audits and evidence.

Table of the 197 CSA CCM v4 controls organized by domain and mapped to the Kudo ISMS policies.

A&A — Audit and Assurance

CodeISMS Policy
A&A-01Compliance Management Policy
A&A-02Compliance Management Policy
A&A-03Compliance Management Policy
A&A-04Compliance Management Policy
A&A-05Documents and Records Policy
A&A-06Documents and Records Policy
A&A-07Compliance Management Policy
A&A-08Compliance Management Policy

AIS — Application and Interface Security

CodeISMS Policy
AIS-01Secure Development Policy
AIS-02Secure Development Policy
AIS-03Secure Development Policy
AIS-04Secure Development Policy
AIS-05Secure Development Policy
AIS-06Secure Development Policy

BCR — Business Continuity and Operational Resilience

CodeISMS Policy
BCR-01Business Continuity Policy
BCR-02Business Continuity Policy
BCR-03Business Continuity Policy
BCR-04Business Continuity Policy
BCR-05Business Continuity Policy
BCR-06Business Continuity Plan
BCR-07Business Continuity Plan
BCR-08Business Continuity Plan
BCR-09Backup and Recovery Policies
BCR-10Backup and Recovery Policies
BCR-11Crisis Management Policy
BCR-12Crisis Management Policy

CCC — Change Control and Configuration Management

CodeISMS Policy
CCC-01Change and Configuration Management Policy
CCC-02Change and Configuration Management Policy
CCC-03Change and Configuration Management Policy
CCC-04Change and Configuration Management Policy
CCC-05Change and Configuration Management Policy
CCC-06Change and Configuration Management Policy
CCC-07Secure Development Policy
CCC-08Secure Development Policy
CCC-09Change and Configuration Management Policy
CCC-10Change and Configuration Management Policy

CEK — Cryptography, Encryption, and Key Management

CodeISMS Policy
CEK-01Communications Security Policy
CEK-02Communications Security Policy
CEK-03Communications Security Policy
CEK-04Communications Security Policy
CEK-05Communications Security Policy
CEK-06Communications Security Policy
CEK-07Communications Security Policy
CEK-08Communications Security Policy
CEK-09Communications Security Policy
CEK-10Communications Security Policy
CEK-11Communications Security Policy
CEK-12Communications Security Policy
CEK-13Communications Security Policy
CEK-14Communications Security Policy
CEK-15Communications Security Policy
CEK-16Communications Security Policy
CEK-17Communications Security Policy
CEK-18Communications Security Policy
CEK-19Communications Security Policy
CEK-20Communications Security Policy
CEK-21Communications Security Policy

DCS — Datacenter Security

CodeISMS Policy
DCS-01Physical Security Policy
DCS-02Physical Security Policy
DCS-03Physical Security Policy
DCS-04Physical Security Policy
DCS-05Physical Security Policy
DCS-06Physical Security Policy
DCS-07IT Security Policy
DCS-08IT Security Policy
DCS-09IT Security Policy
DCS-10IT Security Policy
DCS-11IT Security Policy
DCS-12IT Security Policy

DSP — Data Security and Privacy Lifecycle Management

CodeISMS Policy
DSP-01Asset Management Policy
DSP-02Asset Management Policy
DSP-03Asset Management Policy
DSP-04Asset Management Policy
DSP-05Asset Management Policy
DSP-06Privacy Policy
DSP-07Privacy Policy
DSP-08Privacy Policy
DSP-09Privacy Policy
DSP-10Privacy Policy
DSP-11Privacy Policy
DSP-12Privacy Policy
DSP-13Privacy Policy
DSP-14Privacy Policy
DSP-15Privacy Policy
DSP-16Privacy Policy
DSP-17Privacy Policy
DSP-18Privacy Policy
DSP-19Privacy Policy
DSP-20Privacy Policy
DSP-21Privacy Policy
DSP-22Privacy Policy
DSP-23Privacy Policy

GRC — Governance, Risk, and Compliance

CodeISMS Policy
GRC-01Information Security Policy
GRC-02Information Security Policy
GRC-03Information Security Policy
GRC-04Risk Management Policy
GRC-05Risk Management Policy
GRC-06Compliance Management Policy
GRC-07Compliance Management Policy

HRS — Human Resources Security

CodeISMS Policy
HRS-01Human Resources Security Policy
HRS-02Human Resources Security Policy
HRS-03Human Resources Security Policy
HRS-04Human Resources Security Policy
HRS-05Human Resources Security Policy
HRS-06Human Resources Security Policy
HRS-07Human Resources Security Policy
HRS-08Human Resources Security Policy
HRS-09Human Resources Security Policy
HRS-10Human Resources Security Policy
HRS-11Awareness Management Policy
HRS-12Awareness Management Policy
HRS-13Human Resources Security Policy

IAM — Identity and Access Management

CodeISMS Policy
IAM-01Access Management Policy
IAM-02Access Management Policy
IAM-03Access Management Policy
IAM-04Access Management Policy
IAM-05Access Management Policy
IAM-06Access Management Policy
IAM-07Access Management Policy
IAM-08Access Management Policy
IAM-09Access Management Policy
IAM-10Access Management Policy
IAM-11Access Management Policy
IAM-12Access Management Policy
IAM-13Access Management Policy
IAM-14Access Management Policy

IPY — Interoperability and Portability

CodeISMS Policy
IPY-01Cloud Services Policy
IPY-02Cloud Services Policy
IPY-03Cloud Services Policy
IPY-04Secure Development Policy
IPY-05Secure Development Policy

IVS — Infrastructure and Virtualization Security

CodeISMS Policy
IVS-01IT Security Policy
IVS-02IT Security Policy
IVS-03IT Security Policy
IVS-04IT Security Policy
IVS-05IT Security Policy
IVS-06Communications Security Policy
IVS-07Communications Security Policy
IVS-08Communications Security Policy
IVS-09Communications Security Policy
IVS-10Cloud Services Policy

LOG — Logging and Monitoring

CodeISMS Policy
LOG-01Logging and Monitoring Policy
LOG-02Logging and Monitoring Policy
LOG-03Logging and Monitoring Policy
LOG-04Logging and Monitoring Policy
LOG-05Logging and Monitoring Policy
LOG-06Logging and Monitoring Policy
LOG-07Logging and Monitoring Policy
LOG-08Logging and Monitoring Policy
LOG-09Logging and Monitoring Policy
LOG-10Logging and Monitoring Policy
LOG-11Logging and Monitoring Policy
LOG-12Logging and Monitoring Policy
LOG-13Logging and Monitoring Policy

SEF — Security Incident Management, E-Discovery & Forensics

CodeISMS Policy
SEF-01Incident Management Policy
SEF-02Incident Management Policy
SEF-03Incident Management Policy
SEF-04Incident Management Policy
SEF-05Incident Management Policy
SEF-06Incident Management Policy
SEF-07Incident Management Policy
SEF-08Incident Management Policy
SEF-09Incident Management Policy

STA — Supply Chain Management, Transparency and Accountability

CodeISMS Policy
STA-01Vendor Management Policy
STA-02Vendor Management Policy
STA-03Vendor Management Policy
STA-04Vendor Management Policy
STA-05Vendor Management Policy
STA-06Vendor Management Policy
STA-07Vendor Management Policy
STA-08Vendor Management Policy
STA-09Vendor Management Policy
STA-10Vendor Management Policy

TVM — Threat and Vulnerability Management

CodeISMS Policy
TVM-01Hardening Policy
TVM-02Hardening Policy
TVM-03Hardening Policy
TVM-04Hardening Policy
TVM-05Hardening Policy
TVM-06Hardening Policy
TVM-07Hardening Policy
TVM-08Incident Management Policy
TVM-09Incident Management Policy
TVM-10Incident Management Policy
TVM-11Incident Management Policy

UEM — Universal Endpoint Management

CodeISMS Policy
UEM-01Hardening Policy
UEM-02Hardening Policy
UEM-03Hardening Policy
UEM-04Hardening Policy
UEM-05Hardening Policy
UEM-06Hardening Policy
UEM-07Hardening Policy
UEM-08Access Management Policy
UEM-09Access Management Policy
UEM-10Access Management Policy
UEM-11Access Management Policy
UEM-12Access Management Policy
UEM-13Access Management Policy

CSA CCM with ISMS

Overview of CSA CCM mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.

Domain Mapping

Graphical mapping between CSA CCM and Kudo domains

On this page

A&A — Audit and AssuranceAIS — Application and Interface SecurityBCR — Business Continuity and Operational ResilienceCCC — Change Control and Configuration ManagementCEK — Cryptography, Encryption, and Key ManagementDCS — Datacenter SecurityDSP — Data Security and Privacy Lifecycle ManagementGRC — Governance, Risk, and ComplianceHRS — Human Resources SecurityIAM — Identity and Access ManagementIPY — Interoperability and PortabilityIVS — Infrastructure and Virtualization SecurityLOG — Logging and MonitoringSEF — Security Incident Management, E-Discovery & ForensicsSTA — Supply Chain Management, Transparency and AccountabilityTVM — Threat and Vulnerability ManagementUEM — Universal Endpoint Management