This CCM v4.1 transition pack is the policy set and response workbook a cloud provider needs to complete a CSA STAR submission against the Cloud Controls Matrix. 30 editable Word and Excel documents, downloadable the moment you check out. On this page:
- What is in the toolkit
- Where the CCM v4.1 transition leaves your existing CAIQ
- Who needs CCM v4.1 transition
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the CCM v4.1 transition pack
The Cloud Controls Matrix is organised into control domains, and the CAIQ turns each control into a question you have to answer in writing. The pack provides both halves:
- A policy document behind each CCM domain – governance and risk management, audit and assurance, application and interface security, business continuity, change control and configuration management
- Cryptography, encryption and key management, and datacentre security
- Data security and privacy lifecycle management, including data classification and retention
- Human resources security, identity and access management, and interoperability and portability
- Infrastructure and virtualisation security, logging and monitoring, and security incident management
- Supply chain management, transparency and accountability, threat and vulnerability management, and universal endpoint management
- A CAIQ response workbook, so the questionnaire is answered from the policy set rather than improvised
- Scoping and shared responsibility documentation, plus the STAR registry submission preparation material
Where the CCM v4.1 transition leaves your existing CAIQ
CSA published CCM v4.1 and the matching CAIQ v4.1 in January 2026, replacing v4.0.13. The revision adds new controls and the questionnaire grew accordingly, so a CAIQ completed against v4.0.x has gaps rather than errors – questions that simply were not asked before.
CSA has run a transition rather than a cutover. Both versions are accepted for a period, with v4.1 becoming the only accepted version from December 2027 and v4.0.x withdrawn in January 2028. The practical read is that there is time, but a submission refreshed now should be built on v4.1 rather than refreshed again in eighteen months.
STAR has three levels: Level 1 is a self-assessment published to the registry, Level 2 a third-party audit, and Level 3 continuous monitoring. Level 1 is free to submit and is often the fastest way to answer a procurement security questionnaire, which is why most providers start there. Programme detail is at the CSA STAR page.
Who needs CCM v4.1 transition
Cloud providers who keep receiving bespoke security questionnaires and want a published CAIQ to point at instead. Providers pursuing STAR Level 2 alongside an ISO 27001 certificate, where the CCM maps onto controls they already operate. And providers whose existing registry entry was built on CCM v4.0.x and now needs refreshing.
How the CCM v4.1 transition maps to the framework
The CAIQ is answered from the policy set rather than the other way round, which is the difference between a questionnaire that survives scrutiny and one that reads as marketing. The shared responsibility documentation is included because almost every CCM control has a provider side and a customer side, and reviewers look for that split being stated explicitly.
Frequently asked questions
Which CCM version is this written to?
CCM and CAIQ v4.1, published January 2026. Confirm the version your target customer or auditor expects, since CSA accepts both v4.0.x and v4.1 during the transition.
When does v4.0.x stop being accepted?
CSA has indicated v4.1 becomes the only accepted version from December 2027, with v4.0.x withdrawn in January 2028. Treat those dates as programme guidance and check the current CSA transition notice before you submit.
Is STAR Level 1 really free?
Level 1 is a self-assessment published to the STAR registry at no cost. Level 2 requires a third-party audit and carries the usual assessor fees.
We hold ISO 27001. Does that shorten this?
Yes. The CCM maps closely onto ISO 27001 controls, so most of the underlying evidence is reusable. STAR Level 2 is commonly pursued as an extension of an existing ISO 27001 audit.
How many documents are included?
30 editable templates – 24 Word documents and 6 Excel workbooks – plus a usage guide, an FAQ and a licence file.
Related toolkits
Cloud assurance schemes overlap heavily. See the ISO 27001 Toolkit for the ISMS the CCM maps onto, the BSI C5:2026 Cloud Toolkit for the German market, the SOC2 Toolkit for US customers and the FedRAMP Toolkit for federal buyers. The ISO 27017 and 27018 cloud toolkit supplies the cloud control documentation an ISMS does not already have.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your CCM v4.1 transition downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.