Cloud Controls Matrix

CCMv4 Workshop Session - February 18th [Meeting Minutes]

  • 1.  CCMv4 Workshop Session - February 18th [Meeting Minutes]

    Posted Feb 18, 2021 11:04:00 AM
    Edited by Lefteris Skoutaris Feb 19, 2021 12:47:41 AM
    Hi everyone,
                        please find below the minutes from today's workshop session.

    Agenda Items (AIs)

    1. Touch base on the progress status of the 2 mappings updates (CCMv4.0 – CCMv3.0.1/TSC2017) and Implementation Guidelines development and discuss pending actions
    2. Visit PM consistency checks for the CCMv4.0 - CCMv3.0.1 mapping and pending comments resolution
    3. Kick-off the CCMv4.0 – ISO27001/02/17/18 mapping update to the V4 final control specifications
    4. AoB

     

    Participants (14):

    Madhav Chablani
    Geoff Bird
    Angela Dogan
    Angell Duran
    Damian Heal
    Roberto Hernandez
    Erik Johnson
    Bala Kaundinya
    Giovanni Massard
    Claus Matzke
    Vani Murthy
    Johan Olivier
    Lefteris Skoutaris (PM)
    Ashish Vashishtha

    Meeting Minutes (MMs)

    1. Touch base on the progress status of the 2 mappings update (CCMv4.0 – CCMv3.0.1/TSC2017) and Implementation Guidelines development and discuss pending actions

    CCMv4.0 - CCMv3.0.1 Mapping Update

    • 10 domain mappings have been updated to V4 final and are delivered (PM conducts consistency checks per each - see AI-2),
    • 3 domain mappings (DCS, HRS, IAM) are waiting for a final consolidation of the comments provided by both reviewers (all professionals are active and contacted),
    • 4 domain mappings (CCC, GRC, LOG, TVM)  are waiting for input from 2nd reviewer,
    • Professionals are kindly invited to consult column 'H' under 'Progress Status' tab for pending actions (AP1).
    CCMv4.0 - TSC 2017 Mapping Update
    • The mapping update is progressing at a slower but steady pace with 5/17 mappings delivered (pending consistency checks),
    • Bala offered to help us out with the mapping update of IAM and IVS,
    • PM to provide Madhav with access to the tool (AP2),
    • Professionals are kindly invited to consult column 'H' under 'Progress Status' tab for pending actions (AP3).
    CCMv4.0 Implementation Guidelines (Final Draft)
    • PM produced a 'clean' version of the IG Draft that was delivered in Q4 of last year. The intention here is to produce a final draft version by the end of the month,
    • The group is currently developing IGs for the 14 new controls that were introduced with the release of the V4 version. IG has been developed and currently conducting an additional 2nd review per control (see image of IG dev 'progress status' in the snapshot below),
    • Professionals are kindly invited to consult column 'H' under 'Progress Status' tab for pending actions (AP4).

    2. Visit PM consistency checks for the CCMv4.0 - CCMv3.0.1 mapping and pending comments resolution
    • PM conducts consistency checks per domain mapping to ensure that a 'grammatical' comparison and results are applied and provided per mapping, that the same language, syntax, is used to describe the mapped controls and gap levels uniformly across all domains,
    • 2 domains (IVS, UEM) have been successfully updated, checked for consistency in collaboration with the involved professionals and are made ready for publication.
    • Many thanks to:
      • Glenn and Vani for helping me out with the consistency checks and delivering the final IVS.
      • Vani and Johan for the delivery of final -& also checked for consistency- UEM.
    • PM to carry on with consistency checks on A&A, AIS, DSP, SEF and STA by next call session (AP5)

      3. Kick-off the CCMv4.0 – ISO27001/02/17/18 mapping update to the V4 final control specifications
      • PM has adapted the V4-ISOs mapping tool to include the V4 final control specifications,
      • All professionals participating in the exercise have been contacted and were granted access to the tool,
      • Professionals are kindly invited to consult column 'H' under 'Progress Status' tab for pending actions (AP6).

      4. AoB
      •  Next CCMv4 workshop call is scheduled on February 25th, 6 pm EEST (8 am PST/ 5 pm CET/ 11 am EST),

       

      Action Points (APs)
      AP1/3/4/6: Professionals are kindly invited to consult column 'H' under 'Progress Status' tab for pending actions per ongoing activity (AI-1,2,3).
      AP2: PM to provide Madhav with access to the CCMv4.0-TSC2017 tool.
      AP5: PM to carry on with the consistency checks on A&A, AIS, DSP, SEF and STA by the next call session.


      Please let me know if anything important is missed above. 
      Thank you all for your attendance and support.
      Best regards,

      Lefteris
      CCM WG PM


      CCMv4.0 - CCMv3.0.1 Mapping Update Progress Status Snapshot


      CCMv4.0 - TSC 2017 Mapping Update Progress Status Snapshot


      CCMv4.0 IG Progress Status Snapshot


      ------------------------------
      Eleftherios Skoutaris
      Program Manager
      Cloud Security Alliance
      ------------------------------