1. © Cloud Security Alliance, 2015 Sean Cordero, Chair CCM

2. Agenda © Cloud Security Alliance, 2015 Overview of the CCM CSA STAR & The CCM Industry Adoption and the CCM Looking Ahead: CCM 2016

3. Overview of the CCM © Cloud Security Alliance, 2014. Industry standard for Cloud supply chain security & risk management: Delineates control ownership (Provider, Customer) An anchor for security and compliance posture measurement Provides a framework of 16 control domains Controls map to global regulations and security standards Industry Driven Effort: 120+ Peer Review Participants Participants: AICPA, Microsoft, McKesson, ISACA, Oracle Backbone of the Open Certification Framework and STAR

4. Industry Adoption of the CCM © Cloud Security Alliance, 2014. CSA STAR Certification Based on ISO/IEC 27001:2013 and CCM 3.x Provides enhanced assessment to provide full visibility. Flexible assessment that can be tailored through the Statement of Applicability. CSA and AICPA Cloud Attestation Third party assessment program of cloud providers officially known as CSA Security Trust & Assurance Registry (STAR) Attestation. Enables enhanced, cloud-specific AICIPA SOC 2 Reporting. Illustrative SOC2 with CCM provided on AICPA site.

5. CCM Developments Q2-2015 to Q1-2016 CAIQ and CCM Minor Updates (released 12/11/15) Minor mapping corrections Corrections to control specifications Filled in missing Architecture, Corporate, Supplier Relationship where missing CCM Training Course Under Development Candidate Mappings Released (2/29/16) ISO 27002 ISO 27017 ISO 27018 Mapping Roadmap Shared Assessments New Zealand BSI Germany

6. Looking Ahead: CCM 2016 Next CCM Release: Planned for 2016 Guidance 4.0 – Alignment w/ CCM Standing Control Reviews Established Improve auditability & measurement Clarify intent and language Get involved! Contact ccm-leadership@cloudsecurityalliance.orgccm-leadership@cloudsecurityalliance.org

7. Call to Action Peer Review of ISO 27002, 27017, 27018 Mappings Standing Control Reviews Established Improve auditability & measurement Clarify intent and language Get involved! Contact ccm- leadership@cloudsecurityalliance.orgccm- leadership@cloudsecurityalliance.org

8. Contact Information © Cloud Security Alliance, 2014. Sean Cordero email: sean.cordero@email: sean.cordero@optiv.com Twitter: @sean_cordero

9. ? ? ? ? © Cloud Security Alliance, 2015

10. SaaS CSA STAR Watch © Cloud Security Alliance, 2014. CSA STAR Watch: Subscription based, SaaS tool to manage CCM compliance. Delivers CCM/CAIQ Delivered in a multi-user database. Enables control delegation for assessors. Open Beta started announced at CSA Summit (4/20) Envision integration with STAR and GRC consoles Visit the CSA booth in the South Hall (to the right of the main entrance) # 2621 Demos at 4pm (Tuesday and Wednesday) Interested? Contact research@cloudsecurityalliance.org w/ Subject Line “CSA STAR Watch BETA”.research@cloudsecurityalliance.org