The Cloud Security Alliance Cloud Controls Matrix (CCM) is a cybersecurity control framework designed for cloud computing environments. It consists of 197 control objectives organized across 17 security domains that cover key aspects of cloud technology. The framework provides guidance on security control implementation and defines responsibilities within the cloud supply chain. It includes the Consensus Assessments Initiative Questionnaire (CAIQ), which offers yes/no questions for assessing cloud service providers. The CCM maps controls to multiple industry standards and regulations including ISO, NIST, PCI, and DSS. It aligns with the CSA Security Guidance for Cloud Computing and serves as a framework for cloud security assurance and compliance. The 17 domains include: Audit & Assurance, Application & Interface Security, Business Continuity Management & Operational Resilience, Change Control & Configuration Management, Cryptography Encryption & Key Management, Datacenter Security, Data Security & Privacy, Governance Risk Management & Compliance, Human Resources Security, Identity & Access Management, Interoperability & Portability, Infrastructure & Virtualization Security, Logging & Monitoring, Security Incident Management E-Discovery & Cloud Forensics, Supply Chain Management Transparency & Accountability, Threat & Vulnerability Management, and Universal Endpoint Management. The framework includes implementation guidelines, auditing guidelines, and machine-readable formats (JSON/YAML and OSCAL). Cloud service providers can submit self-assessments to the STAR Registry. Organizations can license the CCM for customization or commercial use in products and consulting services.