Cloud Controls Matrix

I have a question about  "Supplier Relationship".

In V3.0.1, there is a category of "Supplier Relationship" which shows controls is either provider or consumer, or both.

There is no "Supplier Relationship" in V4.

Could you tell me why "Supplier Relationship" is not in V4?

Regards,

    - Morozumi

------------------------------
Masahiro Morozumi
Director
CSA Japan Chapter
------------------------------

It sounds like you're talking about CSP/CSC control ownership under the shared security responsibility model (SSRM). That is covered in CCM V4 in controls STA-01 - STA-06 and included in the CAIQ CSP questionnaire which are posted in the STAR registry for each applicable CSP for current and prospective CSCs to consume. 

------------------------------
Erik Johnson CCSK, CCSP, CISSP, PMP
Senior Research Analyst
Cloud Security Alliance
[email protected]
------------------------------

Original Message:
Sent: Sep 30, 2024 06:39:20 PM
From: Masahiro Morozumi
Subject: Question: Supplier Relationship is not in V4

I have a question about  "Supplier Relationship".

In V3.0.1, there is a category of "Supplier Relationship" which shows controls is either provider or consumer, or both.

There is no "Supplier Relationship" in V4.

Could you tell me why "Supplier Relationship" is not in V4?

Regards,

    - Morozumi

------------------------------
Masahiro Morozumi
Director
CSA Japan Chapter
------------------------------

Hi Morozumi,
The "Typical Control Applicability and Ownership" column, in "CCM" tab provides both SSRM and supplier relationship.

"Shared" means the control applies to both CSP and CSC.
"CSP-owned" applies to CSP only.
"CSC-owned" applies to CSC only.

Please consult the CCM V4 Implementation Guidelines to understand better the rationale behind those selections.
https://cloudsecurityalliance.org/artifacts/ccm-v4-0-implementation-guidelines 

------------------------------
[Lefteris] [Skoutaris]
[Cloud Controls Matrix, Program Manager]
[Cloud Security Alliance]
------------------------------

Original Message:
Sent: Sep 30, 2024 06:39:20 PM
From: Masahiro Morozumi
Subject: Question: Supplier Relationship is not in V4

I have a question about  "Supplier Relationship".

In V3.0.1, there is a category of "Supplier Relationship" which shows controls is either provider or consumer, or both.

There is no "Supplier Relationship" in V4.

Could you tell me why "Supplier Relationship" is not in V4?

Regards,

    - Morozumi

------------------------------
Masahiro Morozumi
Director
CSA Japan Chapter
------------------------------

Thanks, Eric and Lefteris,

It is clear for me. 

    - Morozumi

------------------------------
Masahiro Morozumi
Director
CSA Japan Chapter
------------------------------

Original Message:
Sent: Sep 30, 2024 06:39:20 PM
From: Masahiro Morozumi
Subject: Question: Supplier Relationship is not in V4

I have a question about  "Supplier Relationship".

In V3.0.1, there is a category of "Supplier Relationship" which shows controls is either provider or consumer, or both.

There is no "Supplier Relationship" in V4.

Could you tell me why "Supplier Relationship" is not in V4?

Regards,

    - Morozumi

------------------------------
Masahiro Morozumi
Director
CSA Japan Chapter
------------------------------