Which of the following are the three MAIN phases of the Cloud Controls Matrix (CCM) mapping methodology?

The three main phases of the Cloud Controls Matrix (CCM) mapping methodology are preparation,

execution, and peer review and publication. The CCM mapping methodology is a process to map the

CCM controls to other standards, regulations, or frameworks that are relevant for cloud security. The

mapping helps to identify the commonalities and differences between the CCM and the other

standards, regulations, or frameworks, and to provide guidance for cloud service providers and

customers on how to achieve compliance with multiple requirements using the CCM. The mapping

methodology consists of the following phases1:

Preparation: This phase involves defining the scope, objectives, and deliverables of the mapping

project, as well as identifying the stakeholders, resources, and tools needed. This phase also includes

conducting a preliminary analysis of the CCM and the other standard, regulation, or framework to be

mapped, and establishing the mapping criteria and rules.

Execution: This phase involves performing the actual mapping of the CCM controls to the other

standard, regulation, or framework using a spreadsheet template. This phase also includes

documenting the mapping results, providing explanations and justifications for each mapping

decision, and resolving any issues or conflicts that may arise during the mapping process.

Peer Review and Publication: This phase involves validating and verifying the quality and accuracy of

the mapping results by conducting a peer review with subject matter experts from both the CCM

working group and the other standard, regulation, or framework organization. This phase also

includes finalizing and publishing the mapping document as a CSA artifact, and communicating and

promoting the mapping to the relevant audiences.

Reference := Methodology for the Mapping of the Cloud Controls Matrix1