/map-framework

description: Map CSA CCM controls to other compliance frameworks

CSA CCM Framework Mapping

Maps Cloud Security Alliance Cloud Controls Matrix controls to other major compliance frameworks including ISO 27001, SOC 2, PCI-DSS, NIST, HIPAA, and GDPR.

Arguments

• `$1` - CCM control ID (required, e.g., CEK-01, IAM-06, LOG-08)
• `$2` - Target framework (optional: ISO27001, SOC2, PCIDSS, NIST, HIPAA, GDPR, all)

CCM Control ID Format

**Structure**: `[Domain]-[Number]`

• **Domain**: Three-letter abbreviation (A&A, AIS, BCR, CCC, CEK, DCS, DSP, GRC, HRS, IAM, IPY, IVS, LOG, SEF, STA, TVM, UEM)
• **Number**: Two-digit control number (01-99)

**Examples**:

• `CEK-01`: Cryptography domain, control 01 (Encryption at Rest)
• `IAM-06`: Identity & Access Management, control 06 (Multi-Factor Authentication)
• `LOG-08`: Logging domain, control 08 (SIEM)

Framework Mapping Overview

CCM v4.0 provides comprehensive mappings to enable multi-framework compliance:

Supported Framework Mappings

1. **ISO/IEC 27001:2022** - Information Security Management 2. **SOC 2 Type II** - AICPA Trust Services Criteria 3. **PCI DSS v4.0** - Payment Card Industry Data Security Standard 4. **NIST CSF 2.0** - Cybersecurity Framework 5. **NIST 800-53 Rev 5** - Security and Privacy Controls 6. **HIPAA Security Rule** - Healthcare Information Protection 7. **GDPR** - General Data Protection Regulation 8. **FedRAMP** - Federal Risk and Authorization Management Program 9. **COBIT 2019** - IT Governance Framework 10. **CIS Controls v8** - Center for Internet Security

Common Control Mappings

Encryption Controls

**CEK-01: Encryption at Rest**

• **ISO 27001**: A.8.24 (Use of cryptography)
• **SOC 2**: CC6.1 (Logical and physical access controls)
• **PCI DSS**: 3.5.1 (Disk encryption to protect PAN)
• **NIST 800-53**: SC-28 (Protection of Information at Rest)
• **HIPAA**: 164.312(a)(2)(iv) (Encryption and decryption)
• **GDPR**: Article 32(1)(a) (Pseudonymisation and encryption)

**CEK-02: Encryption in Transit**

• **ISO 27001**: A.8.24 (Use of cryptography)
• **SOC 2**: CC6.7 (Transmission of data protected)
• **PCI DSS**: 4.2.1 (Strong cryptography for transmission)
• **NIST 800-53**: SC-8 (Transmission Confidentiality and Integrity)
• **HIPAA**: 164.312(e)(1) (Transmission security)
• **GDPR**: Article 32(1)(a) (Encryption of personal data)

**CEK-05: Key Management**

• **ISO 27001**: A.8.24 (Use of cryptography)
• **SOC 2**: CC6.1 (Logical and physical access controls)
• **PCI DSS**: 3.6.1 (Generation of strong cryptographic keys)
• **NIST 800-53**: SC-12 (Cryptographic Key Establishment and Management)
• **HIPAA**: 164.312(a)(2)(iv) (Encryption and decryption)

Identity & Access Management

**IAM-01: User Access Policy**

• **ISO 27001**: A.5.15 (Access control), A.5.16 (Identity management)
• **SOC 2**: CC6.1 (Logical and physical access controls)
• **PCI DSS**: 7.1.1 (Access limited to least privilege)
• **NIST 800-53**: AC-2 (Account Management)
• **HIPAA**: 164.308(a)(4)(i) (Access authorization)
• **GDPR**: Article 32(1)(b) (Confidentiality of processing systems)

**IAM-06: Multi-Factor Authentication**

• **ISO 27001**: A.5.17 (Authentication information)
• **SOC 2**: CC6.1 (Logical and physical access controls)
• **PCI DSS**: 8.4.2 (MFA for remote access)
• **NIST 800-53**: IA-2(1) (Multi-factor Authentication)
• **HIPAA**: 164.312(d) (Person or entity authentication)
• **GDPR**: Article 32(1)(b) (Ability to ensure confidentiality)

**IAM-03: User Access Reviews**

• **ISO 27001**: A.5.18 (Access rights review)
• **SOC 2**: CC6.2 (Logical and physical access review)
• **PCI DSS**: 7.2.4 (Review user access at least every 6 months)
• **NIST 800-53**: AC-2(7) (Account Management - Privileged User Accounts)
• **HIPAA**: 164.308(a)(4)(ii)(C) (Access establishment and modification)

Logging & Monitoring

**LOG-01: Audit Logging**

• **ISO 27001**: A.8.15 (Logging)
• **SOC 2**: CC7.2 (System monitoring)
• **PCI DSS**: 10.2.1 (Audit logs for user actions)
• **NIST 800-53**: AU-2 (Event Logging)
• **HIPAA**: 164.312(b) (Audit controls)
• **GDPR**: Article 32(1)(d) (Monitoring effectiveness)

**LOG-08: SIEM**

• **ISO 27001**: A.8.16 (Monitoring activities)
• **SOC 2**: CC7.2 (System monitoring tools)
• **PCI DSS**: 10.6.1 (Review logs daily)
• **NIST 800-53**: AU-6 (Audit Review, Analysis, and Reporting)
• **HIPAA**: 164.308(a)(1)(ii)(D) (Information system activity review)

**LOG-04: Log Retention**

• **ISO 27001**: A.8.15 (Logging)
• **SOC 2**: CC7.2 (System monitoring)
• **PCI DSS**: 10.5.1 (Retain audit logs at least 1 year)
• **NIST 800-53**: AU-11 (Audit Record Retention)
• **HIPAA**: 164.316(b)(2)(i) (Retain documentation 6 years)

Incident Management

**SEF-01: Incident Response Plan**

• **ISO 27001**: A.5.24 (Information security incident management planning)
• **SOC 2**: CC7.3 (Security incidents evaluated and responded to)
• **PCI DSS**: 12.10.1 (Incident response plan)
• **NIST 800-53**: IR-8 (Incident Response Plan)
• **HIPAA**: 164.308(a)(6)(i) (Security incident procedures)
• **GDPR**: Article 33 (Notification of a personal data breach)

**SEF-04: Incident Reporting**

• **ISO 27001**: A.5.25 (Assessment and decision on information security events)
• **SOC 2**: CC7.4 (Communication of security events)
• **PCI DSS**: 12.10.6 (Incident response procedures)
• **NIST 800-53**: IR-6 (Incident Reporting)
• **HIPAA**: 164.308(a)(6)(ii) (Identify and respond to suspected security incidents)
• **GDPR**: Article 33 (72-hour breach notification)

Data Privacy

**DSP-01: Privacy Impact Assessment**

• **ISO 27001**: A.5.36 (Compliance with policies and standards for information security)
• **GDPR**: Article 35 (Data Protection Impact Assessment)
• **NIST 800-53**: RA-8 (Privacy Impact Assessments)

**DSP-03: Data Subject Rights**

• **ISO 27001**: A.5.34 (Privacy and protection of PII)
• **GDPR**: Articles 15-22 (Rights of the data subject)
• **HIPAA**: 164.524 (Access