The CSA CCM MAPPING SCOPE

Operational vs. Policy and Procedural Controls

This effort is focused on the technical and operational elements of the CSA CCM and did not take into account the management elements that are often focused on organization specific policies and procedures (e.g., -01 controls). This decision was made because management specific capabilities are policy-based, and the intent of this effort was focusing on technical and operation capabilities that correlate to ATT&CK mitigations, techniques, and sub-techniques.

Mitigation vs. Monitoring

Capabilities that may only monitor adversary behaviors are out of scope. The focus of this effort is on technical capabilities that mitigate adversary techniques and sub-techniques. Consideration is not given for the potential that an adversary might be dissuaded or change their tactics to try and avoid detection if they thought activity was being monitored.

Controls vs. Control Domain

This effort maps at the control level. Consideration was given to each control's cloud security domain grouping for context.

Implicit vs. Explicit Mitigation

This effort focuses on system-specific technical mitigations (e.g., block USB devices, perform data backups) and capabilities that support those mitigations rather than other, non-technical methods of mitigation (e.g., restrict physical access to systems, develop a backup policy).

Pre-compromise Mitigation

Those techniques only associated with the Pre-compromise Mitigation are excluded. These apply to techniques occurring before an adversary gains Initial Access, such as Reconnaissance and Resource Development techniques, and are considered out of scope.

The CSA CCM scoping decisions are captured below at the cloud security domain level along with our rationale for controls in those domains being in or out of scope. Each CCM domain defines a category and controls fall under those categories. Mappings are at the control level.