csa-ccm 0.1.2 → 0.1.3

data/appveyor.yml

@@ -0,0 +1,36 @@
+# Auto-generated !!! Do not edit it manually
+# use ci-master https://github.com/metanorma/metanorma-build-scripts
+version: '{build}'
+
+cache:
+  - vendor/bundle
+
+environment:
+  matrix:
+    - RUBY_VERSION: 25
+    - RUBY_VERSION: 24
+    - RUBY_VERSION: _trunk
+
+matrix:
+  allow_failures:
+    - RUBY_VERSION: _trunk
+
+install:
+  - ps: . { iwr -useb https://raw.githubusercontent.com/metanorma/metanorma-build-scripts/master/appveyor.ps1 } | iex
+  - refreshenv
+
+build_script:
+  - set PATH=C:\Ruby%RUBY_VERSION%\bin;%PATH%
+  - set GIT_TERMINAL_PROMPT=0
+  - gem install bundler -v "~> 2"
+  - bundle config --local path vendor/bundle
+  - bundle update
+  - bundle install
+
+before_test:
+  - ruby -v
+  - gem -v
+  - bundle -v
+
+test_script:
+  - bundle exec rake

data/caiq-3.0.1.yaml

@@ -6,10 +6,10 @@ ccm:
     source_file: csa-caiq-v3.0.1-12-05-2016.xlsx
   control_domains:
   - id: AIS
-    name: Application & Interface Security
+    title: Application & Interface Security
     controls:
     - id: AIS-01
-      name: Application Security
+      title: Application Security
       specification: Applications and programming interfaces (APIs) shall be designed,
         developed, deployed, and tested in accordance with leading industry standards
         (e.g., OWASP for web applications) and adhere to applicable legal, statutory,
@@ -33,7 +33,7 @@ ccm:
         content: "(SaaS only) Do you review your applications for security vulnerabilities
           and address any issues prior to deployment to production?"
     - id: AIS-02
-      name: Customer Access Requirements
+      title: Customer Access Requirements
       specification: 'Prior to granting customers access to data, assets, and information
         systems, identified security, contractual, and regulatory requirements for
         customer access shall be addressed. '
@@ -42,13 +42,11 @@ ccm:
         content: Are all identified security, contractual, and regulatory requirements
           for customer access contractually addressed and remediated prior to granting
           customers access to data, assets, and information systems?
-    - id: AIS- 02
-      questions:
-      - id: AIS- 02.2
+      - id: AIS-02.2
         content: Are all requirements and trust levels for customers’ access defined
           and documented?
     - id: AIS-03
-      name: Data Integrity
+      title: Data Integrity
       specification: Data input and output integrity routines (i.e., reconciliation
         and edit checks) shall be implemented for application interfaces and databases
         to prevent manual or systematic processing errors, corruption of data, or
@@ -59,7 +57,7 @@ ccm:
           and edit checks) implemented for application interfaces and databases to
           prevent manual or systematic processing errors or corruption of data?
     - id: AIS-04
-      name: Data Security / Integrity
+      title: Data Security / Integrity
       specification: Policies and procedures shall be established and maintained in
         support of data security to include (confidentiality, integrity, and availability)
         across multiple system interfaces, jurisdictions, and business functions to
@@ -70,10 +68,10 @@ ccm:
           (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP,
           CAESARS)?
   - id: AAC
-    name: Audit Assurance & Compliance
+    title: Audit Assurance & Compliance
     controls:
     - id: AAC-01
-      name: Audit Planning
+      title: Audit Planning
       specification: Audit plans shall be developed and maintained to address business
         process disruptions. Auditing plans shall focus on reviewing the effectiveness
         of the implementation of security operations. All audit activities must be
@@ -84,7 +82,7 @@ ccm:
           format (e.g., CloudAudit/A6 URI Ontology, CloudTrust, SCAP/CYBEX, GRC XML,
           ISACA's Cloud Computing Management Audit/Assurance Program, etc.)?
     - id: AAC-02
-      name: Independent Audits
+      title: Independent Audits
       specification: Independent reviews and assessments shall be performed at least
         annually to ensure that the organization addresses nonconformities of established
         policies, standards, procedures, and compliance obligations.
@@ -92,6 +90,32 @@ ccm:
       - id: AAC-02.1
         content: Do you allow tenants to view your SOC2/ISO 27001 or similar third-party
           audit or certification reports?
+      - id: AAC-02.8
+        content: Do you have an internal audit program that allows for cross-functional
+          audit of assessments?
+    - id: AAC-03
+      title: Information System Regulatory Mapping
+      specification: Organizations shall create and maintain a control framework which
+        captures standards, regulatory, legal, and statutory requirements relevant
+        for their business needs. The control framework shall be reviewed at least
+        annually to ensure changes that could affect the business processes are reflected.
+      questions:
+      - id: AAC-03.1
+        content: Do you have the ability to logically segment or encrypt customer
+          data such that data may be produced for a single tenant only, without inadvertently
+          accessing another tenant's data?
+      - id: AAC-03.3
+        content: Do you have the capability to restrict the storage of customer data
+          to specific countries or geographic locations?
+      - id: AAC-03.4
+        content: Do you have a program in place that includes the ability to monitor
+          changes to the regulatory requirements in relevant jurisdictions, adjust
+          your security program for changes to legal requirements, and ensure compliance
+          with relevant regulatory requirements?
+  - id: CO
+    controls:
+    - id: CO-02
+      questions:
       - id: AAC-02.2
         content: Do you conduct network penetration tests of your cloud service infrastructure
           regularly as prescribed by industry best practices and guidance?
@@ -110,36 +134,16 @@ ccm:
       - id: AAC-02.7
         content: Are the results of internal and external audits available to tenants
           at their request?
-      - id: AAC-02.8
-        content: Do you have an internal audit program that allows for cross-functional
-          audit of assessments?
-    - id: AAC-03
-      name: Information System Regulatory Mapping
-      specification: Organizations shall create and maintain a control framework which
-        captures standards, regulatory, legal, and statutory requirements relevant
-        for their business needs. The control framework shall be reviewed at least
-        annually to ensure changes that could affect the business processes are reflected.
+    - id: CO-05
       questions:
-      - id: AAC-03.1
-        content: Do you have the ability to logically segment or encrypt customer
-          data such that data may be produced for a single tenant only, without inadvertently
-          accessing another tenant's data?
       - id: AAC-03.2
         content: Do you have the capability to recover data for a specific customer
           in the case of a failure or data loss?
-      - id: AAC-03.3
-        content: Do you have the capability to restrict the storage of customer data
-          to specific countries or geographic locations?
-      - id: AAC-03.4
-        content: Do you have a program in place that includes the ability to monitor
-          changes to the regulatory requirements in relevant jurisdictions, adjust
-          your security program for changes to legal requirements, and ensure compliance
-          with relevant regulatory requirements?
   - id: BCR
-    name: Business Continuity Management & Operational Resilience
+    title: Business Continuity Management & Operational Resilience
     controls:
     - id: BCR-01
-      name: Business Continuity Planning
+      title: Business Continuity Planning
       specification: |-
         A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:
          • Defined purpose and scope, aligned with relevant dependencies
@@ -151,11 +155,8 @@ ccm:
       questions:
       - id: BCR-01.1
         content: Do you provide tenants with geographically resilient hosting options?
-      - id: BCR-01.2
-        content: Do you provide tenants with infrastructure service failover capability
-          to other providers?
     - id: BCR-02
-      name: Business Continuity Testing
+      title: Business Continuity Testing
       specification: Business continuity and security incident response plans shall
         be subject to testing at planned intervals or upon significant organizational
         or environmental changes. Incident response plans shall involve impacted customers
@@ -167,7 +168,7 @@ ccm:
           or upon significant organizational or environmental changes to ensure continuing
           effectiveness?
     - id: BCR-03
-      name: Power / Telecommunications
+      title: Power / Telecommunications
       specification: Data center utilities services and environmental conditions (e.g.,
         water, power, temperature and humidity controls, telecommunications, and internet
         connectivity) shall be secured, monitored, maintained, and tested for continual
@@ -178,11 +179,8 @@ ccm:
       - id: BCR-03.1
         content: Do you provide tenants with documentation showing the transport route
           of their data between your systems?
-      - id: BCR-03.2
-        content: Can tenants define how their data is transported and through which
-          legal jurisdictions?
     - id: BCR-04
-      name: Documentation
+      title: Documentation
       specification: |-
         Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following:
          • Configuring, installing, and operating the information system
@@ -193,7 +191,7 @@ ccm:
           architecture diagrams, etc.) made available to authorized personnel to ensure
           configuration, installation and operation of the information system?
     - id: BCR-05
-      name: Environmental Risks
+      title: Environmental Risks
       specification: Physical protection against damage from natural causes and disasters,
         as well as deliberate attacks, including fire, flood, atmospheric electrical
         discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion,
@@ -206,7 +204,7 @@ ccm:
           disasters, deliberate attacks) anticipated and designed with countermeasures
           applied?
     - id: BCR-06
-      name: Equipment Location
+      title: Equipment Location
       specification: To reduce the risks from environmental threats, hazards, and
         opportunities for unauthorized access, equipment shall be kept away from locations
         subject to high probability environmental risks and supplemented by redundant
@@ -217,7 +215,7 @@ ccm:
           of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes,
           etc.)?
     - id: BCR-07
-      name: Equipment Maintenance
+      title: Equipment Maintenance
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, for equipment maintenance
         ensuring continuity and availability of operations and support personnel.
@@ -225,21 +223,8 @@ ccm:
       - id: BCR-07.1
         content: If using virtual infrastructure, does your cloud solution include
           independent hardware restore and recovery capabilities?
-      - id: BCR-07.2
-        content: If using virtual infrastructure, do you provide tenants with a capability
-          to restore a Virtual Machine to a previous state in time?
-      - id: BCR-07.3
-        content: If using virtual infrastructure, do you allow virtual machine images
-          to be downloaded and ported to a new cloud provider?
-      - id: BCR-07.4
-        content: If using virtual infrastructure, are machine images made available
-          to the customer in a way that would allow the customer to replicate those
-          images in their own off-site storage location?
-      - id: BCR-07.5
-        content: Does your cloud solution include software/provider independent restore
-          and recovery capabilities?
     - id: BCR-08
-      name: Equipment Power Failures
+      title: Equipment Power Failures
       specification: Protection measures shall be put into place to react to natural
         and man-made threats based upon a geographically-specific business impact
         assessment.
@@ -249,7 +234,7 @@ ccm:
           from utility service outages (e.g., power failures, network disruptions,
           etc.)?
     - id: BCR-09
-      name: Impact Analysis
+      title: Impact Analysis
       specification: |-
         There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following:
          • Identify critical products and services
@@ -264,14 +249,8 @@ ccm:
       - id: BCR-09.1
         content: Do you provide tenants with ongoing visibility and reporting of your
           operational Service Level Agreement (SLA) performance?
-      - id: BCR-09.2
-        content: Do you make standards-based information security metrics (CSA, CAMM,
-          etc.) available to your tenants?
-      - id: BCR-09.3
-        content: Do you provide customers with ongoing visibility and reporting of
-          your SLA performance?
     - id: BCR-10
-      name: Policy
+      title: Policy
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, for appropriate IT
         governance and service management to ensure appropriate planning, delivery
@@ -284,7 +263,7 @@ ccm:
         content: Are policies and procedures established and made available for all
           personnel to adequately support services operations’ roles?
     - id: BCR-11
-      name: Retention Policy
+      title: Retention Policy
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, for defining and adhering
         to the retention period of any critical asset as per established policies
@@ -295,19 +274,90 @@ ccm:
       - id: BCR-11.1
         content: Do you have technical control capabilities to enforce tenant data
           retention policies?
-      - id: BCR-11.2
-        content: Do you have a documented procedure for responding to requests for
-          tenant data from governments or third parties?
       - id: BCR-11.4
         content: Have you implemented backup or redundancy mechanisms to ensure compliance
           with regulatory, statutory, contractual or business requirements?
       - id: BCR-11.5
         content: Do you test your backup or redundancy mechanisms at least annually?
+  - id: RS
+    controls:
+    - id: RS-03
+      questions:
+      - id: BCR-01.2
+        content: Do you provide tenants with infrastructure service failover capability
+          to other providers?
+    - id: RS-08
+      questions:
+      - id: BCR-03.2
+        content: Can tenants define how their data is transported and through which
+          legal jurisdictions?
+    - id: RS-02
+      questions:
+      - id: BCR-09.2
+        content: Do you make standards-based information security metrics (CSA, CAMM,
+          etc.) available to your tenants?
+      - id: BCR-09.3
+        content: Do you provide customers with ongoing visibility and reporting of
+          your SLA performance?
+  - id: OP
+    controls:
+    - id: OP-04
+      questions:
+      - id: BCR-07.2
+        content: If using virtual infrastructure, do you provide tenants with a capability
+          to restore a Virtual Machine to a previous state in time?
+      - id: BCR-07.3
+        content: If using virtual infrastructure, do you allow virtual machine images
+          to be downloaded and ported to a new cloud provider?
+      - id: BCR-07.4
+        content: If using virtual infrastructure, are machine images made available
+          to the customer in a way that would allow the customer to replicate those
+          images in their own off-site storage location?
+      - id: BCR-07.5
+        content: Does your cloud solution include software/provider independent restore
+          and recovery capabilities?
+    - id: OP-03
+      questions:
+      - id: IVS-04.2
+        content: Do you restrict use of the memory oversubscription capabilities present
+          in the hypervisor?
+  - id: DG
+    controls:
+    - id: DG-04
+      questions:
+      - id: BCR-11.2
+        content: Do you have a documented procedure for responding to requests for
+          tenant data from governments or third parties?
+    - id: DG-02
+      questions:
+      - id: DSI-01.2
+        content: Do you provide a capability to identify hardware via policy tags/metadata/hardware
+          tags (e.g., TXT/TPM, VN-Tag, etc.)?
+      - id: DSI-01.3
+        content: Do you have a capability to use system geographic location as an
+          authentication factor?
+      - id: DSI-01.4
+        content: Can you provide the physical location/geography of storage of a tenant’s
+          data upon request?
+      - id: DSI-01.5
+        content: Can you provide the physical location/geography of storage of a tenant's
+          data in advance?
+    - id: DG-03
+      questions:
+      - id: DSI-04.2
+        content: Are mechanisms for label inheritance implemented for objects that
+          act as aggregate containers for data?
+    - id: DG-05
+      questions:
+      - id: DSI-07.2
+        content: Can you provide a published procedure for exiting the service arrangement,
+          including assurance to sanitize all computing resources of tenant data once
+          a customer has exited your environment or has vacated a resource?
   - id: CCC
-    name: Change Control & Configuration Management
+    title: Change Control & Configuration Management
     controls:
     - id: CCC-01
-      name: New Development / Acquisition
+      title: New Development / Acquisition
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to ensure the development
         and/or acquisition of new data, physical or virtual applications, infrastructure
@@ -323,7 +373,7 @@ ccm:
         content: Is documentation available that describes the installation, configuration,
           and use of products/services/features?
     - id: CCC-02
-      name: Outsourced Development
+      title: Outsourced Development
       specification: External business partners shall adhere to the same policies
         and procedures for change management, release, and testing as internal developers
         within the organization (e.g., ITIL service management processes).
@@ -331,11 +381,8 @@ ccm:
       - id: CCC-02.1
         content: Do you have controls in place to ensure that standards of quality
           are being met for all software development?
-      - id: CCC-02.2
-        content: Do you have controls in place to detect source code security defects
-          for any outsourced software development activities?
     - id: CCC-03
-      name: Quality Testing
+      title: Quality Testing
       specification: Organizations shall follow a defined quality change control and
         testing process (e.g., ITIL Service Management) with established baselines,
         testing, and release standards which focus on system availability, confidentiality,
@@ -354,7 +401,7 @@ ccm:
         content: Are mechanisms in place to ensure that all debugging and test code
           elements are removed from released software versions?
     - id: CCC-04
-      name: Unauthorized Software Installations
+      title: Unauthorized Software Installations
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to restrict the installation
         of unauthorized software on organizationally-owned or managed user end-point
@@ -365,7 +412,7 @@ ccm:
         content: Do you have controls in place to restrict and monitor the installation
           of unauthorized software onto your systems?
     - id: CCC-05
-      name: Production Changes
+      title: Production Changes
       specification: |-
         Policies and procedures shall be established for managing the risks associated with applying changes to:
          • Business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations.
@@ -376,11 +423,18 @@ ccm:
         content: Do you provide tenants with documentation that describes your production
           change management procedures and their roles/rights/responsibilities within
           it?
+  - id: RM
+    controls:
+    - id: RM-04
+      questions:
+      - id: CCC-02.2
+        content: Do you have controls in place to detect source code security defects
+          for any outsourced software development activities?
   - id: DSI
-    name: Data Security & Information Lifecycle Management
+    title: Data Security & Information Lifecycle Management
     controls:
     - id: DSI-01
-      name: Classification
+      title: Classification
       specification: Data and objects containing data shall be assigned a classification
         by the data owner based on data type, value, sensitivity, and criticality
         to the organization.
@@ -389,18 +443,6 @@ ccm:
         content: Do you provide a capability to identify virtual machines via policy
           tags/metadata (e.g., tags can be used to limit guest operating systems from
           booting/instantiating/transporting data in the wrong country)?
-      - id: DSI-01.2
-        content: Do you provide a capability to identify hardware via policy tags/metadata/hardware
-          tags (e.g., TXT/TPM, VN-Tag, etc.)?
-      - id: DSI-01.3
-        content: Do you have a capability to use system geographic location as an
-          authentication factor?
-      - id: DSI-01.4
-        content: Can you provide the physical location/geography of storage of a tenant’s
-          data upon request?
-      - id: DSI-01.5
-        content: Can you provide the physical location/geography of storage of a tenant's
-          data in advance?
       - id: DSI-01.6
         content: Do you follow a structured data-labeling standard (e.g., ISO 15489,
           Oasis XML Catalog Specification, CSA data type guidance)?
@@ -408,7 +450,7 @@ ccm:
         content: Do you allow tenants to define acceptable geographical locations
           for data routing or resource instantiation?
     - id: DSI-02
-      name: Data Inventory / Flows
+      title: Data Inventory / Flows
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to inventory, document,
         and maintain data flows for data that is resident (permanently or temporarily)
@@ -427,7 +469,7 @@ ccm:
         content: Can you ensure that data does not migrate beyond a defined geographical
           residency?
     - id: DSI-03
-      name: E-commerce Transactions
+      title: E-commerce Transactions
       specification: Data related to electronic commerce (e-commerce) that traverses
         public networks shall be appropriately classified and protected from fraudulent
         activity, unauthorized disclosure, or modification in such a manner to prevent
@@ -437,12 +479,8 @@ ccm:
         content: Do you provide open encryption methodologies (3.4ES, AES, etc.) to
           tenants in order for them to protect their data if it is required to move
           through public networks (e.g., the Internet)?
-      - id: DSI-03.2
-        content: Do you utilize open encryption methodologies any time your infrastructure
-          components need to communicate with each other via public networks (e.g.,
-          Internet-based replication of data from one environment to another)?
     - id: DSI-04
-      name: Handling / Labeling / Security Policy
+      title: Handling / Labeling / Security Policy
       specification: Policies and procedures shall be established for labeling, handling,
         and the security of data and objects which contain data. Mechanisms for label
         inheritance shall be implemented for objects that act as aggregate containers
@@ -451,11 +489,8 @@ ccm:
       - id: DSI-04.1
         content: Are policies and procedures established for labeling, handling and
           the security of data and objects that contain data?
-      - id: DSI-04.2
-        content: Are mechanisms for label inheritance implemented for objects that
-          act as aggregate containers for data?
     - id: DSI-05
-      name: Nonproduction Data
+      title: Nonproduction Data
       specification: Production data shall not be replicated or used in non-production
         environments. Any use of customer data in non-production environments requires
         explicit, documented approval from all customers whose data is affected, and
@@ -466,7 +501,7 @@ ccm:
         content: Do you have procedures in place to ensure production data shall not
           be replicated or used in non-production environments?
     - id: DSI-06
-      name: Ownership / Stewardship
+      title: Ownership / Stewardship
       specification: All data shall be designated with stewardship, with assigned
         responsibilities defined, documented, and communicated.
       questions:
@@ -474,7 +509,7 @@ ccm:
         content: Are the responsibilities regarding data stewardship defined, assigned,
           documented, and communicated?
     - id: DSI-07
-      name: Secure Disposal
+      title: Secure Disposal
       specification: Policies and procedures shall be established with supporting
         business processes and technical measures implemented for the secure disposal
         and complete removal of data from all storage media, ensuring data is not
@@ -483,15 +518,174 @@ ccm:
       - id: DSI-07.1
         content: Do you support secure deletion (e.g., degaussing/cryptographic wiping)
           of archived and backed-up data as determined by the tenant?
-      - id: DSI-07.2
-        content: Can you provide a published procedure for exiting the service arrangement,
-          including assurance to sanitize all computing resources of tenant data once
-          a customer has exited your environment or has vacated a resource?
+  - id: IS
+    controls:
+    - id: IS-28
+      questions:
+      - id: DSI-03.2
+        content: Do you utilize open encryption methodologies any time your infrastructure
+          components need to communicate with each other via public networks (e.g.,
+          Internet-based replication of data from one environment to another)?
+    - id: IS-19
+      questions:
+      - id: EKM-02.2
+        content: Do you have a capability to manage encryption keys on behalf of tenants?
+      - id: EKM-02.3
+        content: Do you maintain key management procedures?
+      - id: EKM-02.4
+        content: Do you have documented ownership for each stage of the lifecycle
+          of encryption keys?
+    - id: IS-18
+      questions:
+      - id: EKM-03.2
+        content: Do you leverage encryption to protect data and virtual machine images
+          during transport across and between networks and hypervisor instances?
+    - id: IS-04
+      questions:
+      - id: GRM-01.2
+        content: Do you have the capability to continuously monitor and report the
+          compliance of your infrastructure against your information security baselines?
+      - id: GRM-01.3
+        content: Do you allow your clients to provide their own trusted virtual machine
+          image to ensure conformance to their own internal standards?
+    - id: IS-06
+      questions:
+      - id: GRM-07.2
+        content: Are employees made aware of what actions could be taken in the event
+          of a violation via their policies and procedures?
+    - id: IS-27
+      questions:
+      - id: HRS-01.2
+        content: Is your Privacy Policy aligned with industry standards?
+    - id: IS-26
+      questions:
+      - id: HRS-08.2
+        content: Do you collect or create metadata about tenant data usage through
+          inspection technologies (e.g., search engines, etc.)?
+      - id: HRS-08.3
+        content: Do you allow tenants to opt out of having their data/metadata accessed
+          via inspection technologies?
+    - id: IS-11
+      questions:
+      - id: HRS-09.2
+        content: Are administrators and data stewards properly educated on their legal
+          responsibilities with regard to security and data integrity?
+    - id: IS-16
+      questions:
+      - id: HRS-10.2
+        content: Are users made aware of their responsibilities for maintaining a
+          safe and secure working environment?
+      - id: HRS-10.3
+        content: Are users made aware of their responsibilities for leaving unattended
+          equipment in a secure manner?
+      - id: HRS-11.2
+        content: Do your data management policies and procedures include a tamper
+          audit or software integrity function for unauthorized access to tenant data?
+      - id: HRS-11.3
+        content: Does the virtual machine management infrastructure include a tamper
+          audit or software integrity function to detect changes to the build/configuration
+          of the virtual machine?
+    - id: IS-07
+      questions:
+      - id: IAM-02.2
+        content: Do you provide metrics to track the speed with which you are able
+          to remove systems access that is no longer required for business purposes?
+    - id: IS-33
+      questions:
+      - id: IAM-06.2
+        content: Are controls in place to prevent unauthorized access to tenant application,
+          program, or object source code, and assure it is restricted to authorized
+          personnel only?
+    - id: IS-08
+      questions:
+      - id: IAM-08.2
+        content: Do you have a method of aligning provider and tenant data classification
+          methodologies for access control purposes?
+    - id: IS-10
+      questions:
+      - id: IAM-10.2
+        content: If users are found to have inappropriate entitlements, are all remediation
+          and certification actions recorded?
+      - id: IAM-10.3
+        content: Will you share user entitlement remediation and certification reports
+          with your tenants, if inappropriate access may have been allowed to tenant
+          data?
+    - id: IS-09
+      questions:
+      - id: IAM-11.2
+        content: Is any change in user access status intended to include termination
+          of employment, contract or agreement, change of employment or transfer within
+          the organization?
+    - id: IS-34
+      questions:
+      - id: IAM-13.2
+        content: Do you have the capability to detect attacks that target the virtual
+          infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
+      - id: IAM-13.3
+        content: Are attacks that target the virtual infrastructure prevented with
+          technical controls?
+    - id: IS-22
+      questions:
+      - id: SEF-02.2
+        content: Do you integrate customized tenant requirements into your security
+          incident response plans?
+      - id: SEF-02.3
+        content: Do you publish a roles and responsibilities document specifying what
+          you vs. your tenants are responsible for during security incidents?
+    - id: IS-23
+      questions:
+      - id: SEF-03.2
+        content: Does your logging and monitoring framework allow isolation of an
+          incident to specific tenants?
+    - id: IS-24
+      questions:
+      - id: SEF-04.2
+        content: Does your incident response capability include the use of legally
+          admissible forensic data collection and analysis techniques?
+      - id: SEF-04.3
+        content: Are you capable of supporting litigation holds (freeze of data from
+          a specific point in time) for a specific tenant without freezing other tenant
+          data?
+      - id: SEF-04.4
+        content: Do you enforce and attest to tenant data separation when producing
+          data in response to legal subpoenas?
+    - id: IS-25
+      questions:
+      - id: SEF-05.2
+        content: Will you share statistical information for security incident data
+          with your tenants upon request?
+    - id: IS-31
+      questions:
+      - id: STA-03.2
+        content: Do you provide tenants with capacity planning and use reports?
+    - id: IS-21
+      questions:
+      - id: TVM-01.2
+        content: Do you ensure that security threat detection systems using signatures,
+          lists, or behavioral patterns are updated across all infrastructure components
+          within industry accepted time frames?
+    - id: IS-20
+      questions:
+      - id: TVM-02.2
+        content: Do you conduct application-layer vulnerability scans regularly as
+          prescribed by industry best practices?
+      - id: TVM-02.3
+        content: Do you conduct local operating system-layer vulnerability scans regularly
+          as prescribed by industry best practices?
+      - id: TVM-02.4
+        content: Will you make the results of vulnerability scans available to tenants
+          at their request?
+      - id: TVM-02.5
+        content: Do you have a capability to rapidly patch vulnerabilities across
+          all of your computing devices, applications, and systems?
+      - id: TVM-02.6
+        content: Will you provide your risk-based systems patching time frames to
+          your tenants upon request?
   - id: DCS
-    name: Datacenter Security
+    title: Datacenter Security
     controls:
     - id: DCS-01
-      name: Asset Management
+      title: Asset Management
       specification: Assets must be classified in terms of business criticality, service-level
         expectations, and operational continuity requirements. A complete inventory
         of business-critical assets located at all sites and/or geographical locations
@@ -501,11 +695,8 @@ ccm:
       - id: DCS-01.1
         content: Do you maintain a complete inventory of all of your critical assets
           that includes ownership of the asset?
-      - id: DCS-01.2
-        content: Do you maintain a complete inventory of all of your critical supplier
-          relationships?
     - id: DCS-02
-      name: Controlled Access Points
+      title: Controlled Access Points
       specification: Physical security perimeters (e.g., fences, walls, barriers,
         guards, gates, electronic surveillance, physical authentication mechanisms,
         reception desks, and security patrols) shall be implemented to safeguard sensitive
@@ -516,7 +707,7 @@ ccm:
           guards, gates, electronic surveillance, physical authentication mechanisms,
           reception desks, and security patrols) implemented?
     - id: DCS-03
-      name: Equipment Identification
+      title: Equipment Identification
       specification: Automated equipment identification shall be used as a method
         of connection authentication. Location-aware technologies may be used to validate
         connection authentication integrity based on known equipment location.
@@ -525,7 +716,7 @@ ccm:
         content: Is automated equipment identification used as a method to validate
           connection authentication integrity based on known equipment location?
     - id: DCS-04
-      name: Offsite Authorization
+      title: Offsite Authorization
       specification: Authorization must be obtained prior to relocation or transfer
         of hardware, software, or data to an offsite premises.
       questions:
@@ -534,7 +725,7 @@ ccm:
           in which data may be moved from one physical location to another (e.g.,
           offsite backups, business continuity failovers, replication)?
     - id: DCS-05
-      name: Offsite Equipment
+      title: Offsite Equipment
       specification: Policies and procedures shall be established for the secure disposal
         of equipment (by asset type) used outside the organization's premise. This
         shall include a wiping solution or destruction process that renders recovery
@@ -546,7 +737,7 @@ ccm:
         content: Can you provide tenants with evidence documenting your policies and
           procedures governing asset management and repurposing of equipment?
     - id: DCS-06
-      name: Policy
+      title: Policy
       specification: Policies and procedures shall be established, and supporting
         business processes implemented, for maintaining a safe and secure working
         environment in offices, rooms, facilities, and secure areas storing sensitive
@@ -560,7 +751,7 @@ ccm:
         content: Can you provide evidence that your personnel and involved third parties
           have been trained regarding your documented policies, standards, and procedures?
     - id: DCS-07
-      name: Secure Area Authorization
+      title: Secure Area Authorization
       specification: Ingress and egress to secure areas shall be constrained and monitored
         by physical access control mechanisms to ensure that only authorized personnel
         are allowed access.
@@ -570,7 +761,7 @@ ccm:
           their data is allowed to move into/out of (to address legal jurisdictional
           considerations based on where data is stored vs. accessed)?
     - id: DCS-08
-      name: Unauthorized Persons Entry
+      title: Unauthorized Persons Entry
       specification: Ingress and egress points such as service areas and other points
         where unauthorized personnel may enter the premises shall be monitored, controlled
         and, if possible, isolated from data storage and processing facilities to
@@ -581,18 +772,25 @@ ccm:
           where unauthorized personnel may enter the premises, monitored, controlled
           and isolated from data storage and process?
     - id: DCS-09
-      name: User Access
+      title: User Access
       specification: Physical access to information assets and functions by users
         and support personnel shall be restricted.
       questions:
       - id: DCS-09.1
         content: Do you restrict physical access to information assets and functions
           by users and support personnel?
+  - id: FS
+    controls:
+    - id: FS-08
+      questions:
+      - id: DCS-01.2
+        content: Do you maintain a complete inventory of all of your critical supplier
+          relationships?
   - id: EKM
-    name: Encryption & Key Management
+    title: Encryption & Key Management
     controls:
     - id: EKM-01
-      name: Entitlement
+      title: Entitlement
       specification: Keys must have identifiable owners (binding keys to identities)
         and there shall be key management policies.
       questions:
@@ -600,7 +798,7 @@ ccm:
         content: Do you have key management policies binding keys to identifiable
           owners?
     - id: EKM-02
-      name: Key Generation
+      title: Key Generation
       specification: Policies and procedures shall be established for the management
         of cryptographic keys in the service's cryptosystem (e.g., lifecycle management
         from key generation to revocation and replacement, public key infrastructure,
@@ -614,18 +812,11 @@ ccm:
       - id: EKM-02.1
         content: Do you have a capability to allow creation of unique encryption keys
           per tenant?
-      - id: EKM-02.2
-        content: Do you have a capability to manage encryption keys on behalf of tenants?
-      - id: EKM-02.3
-        content: Do you maintain key management procedures?
-      - id: EKM-02.4
-        content: Do you have documented ownership for each stage of the lifecycle
-          of encryption keys?
       - id: EKM-02.5
         content: Do you utilize any third party/open source/proprietary frameworks
           to manage encryption keys?
     - id: EKM-03
-      name: Encryption
+      title: Encryption
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, for the use of encryption
         protocols for protection of sensitive data in storage (e.g., file servers,
@@ -636,9 +827,6 @@ ccm:
       - id: EKM-03.1
         content: Do you encrypt tenant data at rest (on disk/storage) within your
           environment?
-      - id: EKM-03.2
-        content: Do you leverage encryption to protect data and virtual machine images
-          during transport across and between networks and hypervisor instances?
       - id: EKM-03.3
         content: Do you support tenant-generated encryption keys or permit tenants
           to encrypt data to an identity without access to a public key certificate
@@ -647,7 +835,7 @@ ccm:
         content: Do you have documentation establishing and defining your encryption
           management policies, procedures, and guidelines?
     - id: EKM-04
-      name: Storage and Access
+      title: Storage and Access
       specification: Platform and data appropriate encryption (e.g., AES-256) in open/validated
         formats and standard algorithms shall be required. Keys shall not be stored
         in the cloud (i.e. at the cloud provider in question), but maintained by the
@@ -665,10 +853,10 @@ ccm:
       - id: EKM-04.4
         content: Do you have separate key management and key usage duties?
   - id: GRM
-    name: Governance and Risk Management
+    title: Governance and Risk Management
     controls:
     - id: GRM-01
-      name: Baseline Requirements
+      title: Baseline Requirements
       specification: Baseline security requirements shall be established for developed
         or acquired, organizationally-owned or managed, physical or virtual, applications
         and infrastructure system, and network components that comply with applicable
@@ -683,14 +871,8 @@ ccm:
         content: Do you have documented information security baselines for every component
           of your infrastructure (e.g., hypervisors, operating systems, routers, DNS
           servers, etc.)?
-      - id: GRM-01.2
-        content: Do you have the capability to continuously monitor and report the
-          compliance of your infrastructure against your information security baselines?
-      - id: GRM-01.3
-        content: Do you allow your clients to provide their own trusted virtual machine
-          image to ensure conformance to their own internal standards?
     - id: GRM-02
-      name: Risk Assessments
+      title: Risk Assessments
       specification: |-
         Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
          • Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure
@@ -705,7 +887,7 @@ ccm:
         content: Do you conduct risk assessments associated with data governance requirements
           at least once a year?
     - id: GRM-03
-      name: Management Oversight
+      title: Management Oversight
       specification: Managers are responsible for maintaining awareness of, and complying
         with, security policies, procedures, and standards that are relevant to their
         area of responsibility.
@@ -716,7 +898,7 @@ ccm:
           and standards for both themselves and their employees as they pertain to
           the manager and employees' area of responsibility?
     - id: GRM-04
-      name: Management Program
+      title: Management Program
       specification: |-
         An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business:
          • Risk management
@@ -736,7 +918,7 @@ ccm:
         content: Do you review your Information Security Management Program (ISMP)
           at least once a year?
     - id: GRM-05
-      name: Management Support / Involvement
+      title: Management Support / Involvement
       specification: Executive and line management shall take formal action to support
         information security through clearly-documented direction and commitment,
         and shall ensure the action has been assigned.
@@ -745,7 +927,7 @@ ccm:
         content: Do you ensure your providers adhere to your information security
           and privacy policies?
     - id: GRM-06
-      name: Policy
+      title: Policy
       specification: Information security policies and procedures shall be established
         and made readily available for review by all impacted personnel and external
         business relationships. Information security policies must be authorized by
@@ -767,7 +949,7 @@ ccm:
         content: Do you disclose which controls, standards, certifications, and/or
           regulations you comply with?
     - id: GRM-07
-      name: Policy Enforcement
+      title: Policy Enforcement
       specification: A formal disciplinary or sanction policy shall be established
         for employees who have violated security policies and procedures. Employees
         shall be made aware of what action might be taken in the event of a violation,
@@ -776,11 +958,8 @@ ccm:
       - id: GRM-07.1
         content: Is a formal disciplinary or sanction policy established for employees
           who have violated security policies and procedures?
-      - id: GRM-07.2
-        content: Are employees made aware of what actions could be taken in the event
-          of a violation via their policies and procedures?
     - id: GRM-08
-      name: Business / Policy Change Impacts
+      title: Business / Policy Change Impacts
       specification: Risk assessment results shall include updates to security policies,
         procedures, standards, and controls to ensure that they remain relevant and
         effective.
@@ -789,7 +968,7 @@ ccm:
         content: Do risk assessment results include updates to security policies,
           procedures, standards, and controls to ensure they remain relevant and effective?
     - id: GRM-09
-      name: Policy Reviews
+      title: Policy Reviews
       specification: The organization's business leadership (or other accountable
         business role or function) shall review the information security policy at
         planned intervals or as a result of changes to the organization to ensure
@@ -804,7 +983,7 @@ ccm:
         content: Do you perform, at minimum, annual reviews to your privacy and security
           policies?
     - id: GRM-10
-      name: Assessments
+      title: Assessments
       specification: Aligned with the enterprise-wide framework, formal risk assessments
         shall be performed at least annually or at planned intervals, (and in conjunction
         with any changes to information systems) to determine the likelihood and impact
@@ -818,12 +997,8 @@ ccm:
           and performed at least annually, or at planned intervals, determining the
           likelihood and impact of all identified risks, using qualitative and quantitative
           methods?
-      - id: GRM-10.2
-        content: Is the likelihood and impact associated with inherent and residual
-          risk determined independently, considering all risk categories (e.g., audit
-          results, threat and vulnerability analysis, and regulatory compliance)?
     - id: GRM-11
-      name: Program
+      title: Program
       specification: Risks shall be mitigated to an acceptable level. Acceptance levels
         based on risk criteria shall be established and documented in accordance with
         reasonable resolution time frames and stakeholder approval.
@@ -831,14 +1006,41 @@ ccm:
       - id: GRM-11.1
         content: Do you have a documented, organization-wide program in place to manage
           risk?
+  - id: RI
+    controls:
+    - id: RI-02
+      questions:
+      - id: GRM-10.2
+        content: Is the likelihood and impact associated with inherent and residual
+          risk determined independently, considering all risk categories (e.g., audit
+          results, threat and vulnerability analysis, and regulatory compliance)?
+    - id: RI-01
+      questions:
       - id: GRM-11.2
         content: Do you make available documentation of your organization-wide risk
           management program?
+    - id: RI-05
+      questions:
+      - id: IAM-07.2
+        content: Do you monitor service continuity with upstream providers in the
+          event of provider failure?
+      - id: IAM-07.3
+        content: Do you have more than one provider for each service you depend on?
+      - id: IAM-07.4
+        content: Do you provide access to operational redundancy and continuity summaries,
+          including the services you depend on?
+      - id: IAM-07.5
+        content: Do you provide the tenant the ability to declare a disaster?
+      - id: IAM-07.6
+        content: Do you provide a tenant-triggered failover option?
+      - id: IAM-07.7
+        content: Do you share your business continuity and redundancy plans with your
+          tenants?
   - id: HRS
-    name: Human Resources
+    title: Human Resources
     controls:
     - id: HRS-01
-      name: Asset Returns
+      title: Asset Returns
       specification: Upon termination of workforce personnel and/or expiration of
         external business relationships, all organizationally-owned assets shall be
         returned within an established period.
@@ -846,10 +1048,8 @@ ccm:
       - id: HRS-01.1
         content: Are systems in place to monitor for privacy breaches and notify tenants
           expeditiously if a privacy event may have impacted their data?
-      - id: HRS-01.2
-        content: Is your Privacy Policy aligned with industry standards?
     - id: HRS-02
-      name: Background Screening
+      title: Background Screening
       specification: Pursuant to local laws, regulations, ethics, and contractual
         constraints, all employment candidates, contractors, and third parties shall
         be subject to background verification proportional to the data classification
@@ -860,7 +1060,7 @@ ccm:
           are all employment candidates, contractors, and involved third parties subject
           to background verification?
     - id: HRS-03
-      name: Employment Agreements
+      title: Employment Agreements
       specification: Employment agreements shall incorporate provisions and/or terms
         for adherence to established information governance and security policies
         and must be signed by newly hired or on-boarded workforce personnel (e.g.,
@@ -870,8 +1070,6 @@ ccm:
       - id: HRS-03.1
         content: Do you specifically train your employees regarding their specific
           role and the information security controls they must fulfill?
-      - id: HRS-03.2
-        content: Do you document employee acknowledgment of training they have completed?
       - id: HRS-03.3
         content: Are all personnel required to sign NDA or Confidentiality Agreements
           as a condition of employment to protect customer/tenant information?
@@ -882,7 +1080,7 @@ ccm:
         content: Are personnel trained and provided with awareness programs at least
           once a year?
     - id: HRS-04
-      name: Employment Termination
+      title: Employment Termination
       specification: Roles and responsibilities for performing employment termination
         or change in employment procedures shall be assigned, documented, and communicated.
       questions:
@@ -893,7 +1091,7 @@ ccm:
         content: Do the above procedures and guidelines account for timely revocation
           of access and return of assets?
     - id: HRS-05
-      name: Portable / Mobile Devices
+      title: Portable / Mobile Devices
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to manage business
         risks associated with permitting mobile device access to corporate resources
@@ -908,7 +1106,7 @@ ccm:
           (PDAs)), which are generally higher-risk than non-portable devices (e.g.,
           desktop computers at the provider organization’s facilities)?
     - id: HRS-06
-      name: Non-Disclosure Agreements
+      title: Non-Disclosure Agreements
       specification: Requirements for non-disclosure or confidentiality agreements
         reflecting the organization's needs for the protection of data and operational
         details shall be identified, documented, and reviewed at planned intervals.
@@ -918,7 +1116,7 @@ ccm:
           reflecting the organization's needs for the protection of data and operational
           details identified, documented, and reviewed at planned intervals?
     - id: HRS-07
-      name: Roles / Responsibilities
+      title: Roles / Responsibilities
       specification: Roles and responsibilities of contractors, employees, and third-party
         users shall be documented as they relate to information assets and security.
       questions:
@@ -926,7 +1124,7 @@ ccm:
         content: Do you provide tenants with a role definition document clarifying
           your administrative responsibilities versus those of the tenant?
     - id: HRS-08
-      name: Acceptable Use
+      title: Acceptable Use
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, for defining allowances
         and conditions for permitting usage of organizationally-owned or managed user
@@ -939,14 +1137,8 @@ ccm:
       - id: HRS-08.1
         content: Do you provide documentation regarding how you may access tenant
           data and metadata?
-      - id: HRS-08.2
-        content: Do you collect or create metadata about tenant data usage through
-          inspection technologies (e.g., search engines, etc.)?
-      - id: HRS-08.3
-        content: Do you allow tenants to opt out of having their data/metadata accessed
-          via inspection technologies?
     - id: HRS-09
-      name: Training / Awareness
+      title: Training / Awareness
       specification: A security awareness training program shall be established for
         all contractors, third-party users, and employees of the organization and
         mandated when appropriate. All individuals with access to organizational data
@@ -959,11 +1151,8 @@ ccm:
           program for cloud-related access and data management issues (e.g., multi-tenancy,
           nationality, cloud delivery model, segregation of duties implications, and
           conflicts of interest) for all persons with access to tenant data?
-      - id: HRS-09.2
-        content: Are administrators and data stewards properly educated on their legal
-          responsibilities with regard to security and data integrity?
     - id: HRS-10
-      name: User Responsibility
+      title: User Responsibility
       specification: |-
         All personnel shall be made aware of their roles and responsibilities for:
          • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
@@ -973,14 +1162,8 @@ ccm:
         content: Are users made aware of their responsibilities for maintaining awareness
           and compliance with published security policies, procedures, standards,
           and applicable regulatory requirements?
-      - id: HRS-10.2
-        content: Are users made aware of their responsibilities for maintaining a
-          safe and secure working environment?
-      - id: HRS-10.3
-        content: Are users made aware of their responsibilities for leaving unattended
-          equipment in a secure manner?
     - id: HRS-11
-      name: Workspace
+      title: Workspace
       specification: Policies and procedures shall be established to require that
         unattended workspaces do not have openly visible (e.g., on a desktop) sensitive
         documents and user computing sessions had been disabled after an established
@@ -989,18 +1172,17 @@ ccm:
       - id: HRS-11.1
         content: Do your data management policies and procedures address tenant and
           service level conflicts of interests?
-      - id: HRS-11.2
-        content: Do your data management policies and procedures include a tamper
-          audit or software integrity function for unauthorized access to tenant data?
-      - id: HRS-11.3
-        content: Does the virtual machine management infrastructure include a tamper
-          audit or software integrity function to detect changes to the build/configuration
-          of the virtual machine?
+  - id: HR
+    controls:
+    - id: HR-02
+      questions:
+      - id: HRS-03.2
+        content: Do you document employee acknowledgment of training they have completed?
   - id: IAM
-    name: Identity & Access Management
+    title: Identity & Access Management
     controls:
     - id: IAM-01
-      name: Audit Tools Access
+      title: Audit Tools Access
       specification: Access to, and use of, audit tools that interact with the organization's
         information systems shall be appropriately segmented and restricted to prevent
         compromise and misuse of log data.
@@ -1013,7 +1195,7 @@ ccm:
         content: Do you monitor and log privileged access (e.g., administrator level)
           to information security management systems?
     - id: IAM-02
-      name: User Access Policy
+      title: User Access Policy
       specification: |-
         User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following:
          • Procedures, supporting roles, and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function (e.g., internal employee and contingent staff personnel changes, customer-controlled access, suppliers' business relationships, or other third-party business relationships)
@@ -1029,11 +1211,8 @@ ccm:
       - id: IAM-02.1
         content: Do you have controls in place ensuring timely removal of systems
           access that is no longer required for business purposes?
-      - id: IAM-02.2
-        content: Do you provide metrics to track the speed with which you are able
-          to remove systems access that is no longer required for business purposes?
     - id: IAM-03
-      name: Diagnostic / Configuration Ports Access
+      title: Diagnostic / Configuration Ports Access
       specification: User access to diagnostic and configuration ports shall be restricted
         to authorized individuals and applications.
       questions:
@@ -1041,7 +1220,7 @@ ccm:
         content: Do you use dedicated secure networks to provide management access
           to your cloud service infrastructure?
     - id: IAM-04
-      name: Policies and Procedures
+      title: Policies and Procedures
       specification: Policies and procedures shall be established to store and manage
         identity information about every person who accesses IT infrastructure and
         to determine their level of access. Policies shall also be developed to control
@@ -1054,7 +1233,7 @@ ccm:
         content: Do you manage and store the user identity of all personnel who have
           network access, including their level of access?
     - id: IAM-05
-      name: Segregation of Duties
+      title: Segregation of Duties
       specification: User access policies and procedures shall be established, and
         supporting business processes and technical measures implemented, for restricting
         user access as per defined segregation of duties to address business risks
@@ -1064,7 +1243,7 @@ ccm:
         content: Do you provide tenants with documentation on how you maintain segregation
           of duties within your cloud service offering?
     - id: IAM-06
-      name: Source Code Access Restriction
+      title: Source Code Access Restriction
       specification: Access to the organization's own developed applications, program,
         or object source code, or any other form of intellectual property (IP), and
         use of proprietary software shall be appropriately restricted following the
@@ -1075,12 +1254,8 @@ ccm:
         content: Are controls in place to prevent unauthorized access to your application,
           program, or object source code, and assure it is restricted to authorized
           personnel only?
-      - id: IAM-06.2
-        content: Are controls in place to prevent unauthorized access to tenant application,
-          program, or object source code, and assure it is restricted to authorized
-          personnel only?
     - id: IAM-07
-      name: Third Party Access
+      title: Third Party Access
       specification: The identification, assessment, and prioritization of risks posed
         by business processes requiring third-party access to the organization's information
         systems and data shall be followed by coordinated application of resources
@@ -1090,23 +1265,8 @@ ccm:
       questions:
       - id: IAM-07.1
         content: Do you provide multi-failure disaster recovery capability?
-      - id: IAM-07.2
-        content: Do you monitor service continuity with upstream providers in the
-          event of provider failure?
-      - id: IAM-07.3
-        content: Do you have more than one provider for each service you depend on?
-      - id: IAM-07.4
-        content: Do you provide access to operational redundancy and continuity summaries,
-          including the services you depend on?
-      - id: IAM-07.5
-        content: Do you provide the tenant the ability to declare a disaster?
-      - id: IAM-07.6
-        content: Do you provide a tenant-triggered failover option?
-      - id: IAM-07.7
-        content: Do you share your business continuity and redundancy plans with your
-          tenants?
     - id: IAM-08
-      name: User Access Restriction / Authorization
+      title: User Access Restriction / Authorization
       specification: Policies and procedures are established for permissible storage
         and access of identities used for authentication to ensure identities are
         only accessible based on rules of least privilege and replication limitation
@@ -1114,11 +1274,8 @@ ccm:
       questions:
       - id: IAM-08.1
         content: Do you document how you grant and approve access to tenant data?
-      - id: IAM-08.2
-        content: Do you have a method of aligning provider and tenant data classification
-          methodologies for access control purposes?
     - id: IAM-09
-      name: User Access Authorization
+      title: User Access Authorization
       specification: Provisioning user access (e.g., employees, contractors, customers
         (tenants), business partners and/or supplier relationships) to data and organizationally-owned
         or managed (physical and virtual) applications, infrastructure systems, and
@@ -1141,7 +1298,7 @@ ccm:
           owned or managed (physical and virtual) applications, infrastructure systems
           and network components?
     - id: IAM-10
-      name: User Access Reviews
+      title: User Access Reviews
       specification: User access shall be authorized and revalidated for entitlement
         appropriateness, at planned intervals, by the organization's business leadership
         or other accountable business role or function supported by evidence to demonstrate
@@ -1153,15 +1310,8 @@ ccm:
         content: Do you require at least annual certification of entitlements for
           all system users and administrators (exclusive of users maintained by your
           tenants)?
-      - id: IAM-10.2
-        content: If users are found to have inappropriate entitlements, are all remediation
-          and certification actions recorded?
-      - id: IAM-10.3
-        content: Will you share user entitlement remediation and certification reports
-          with your tenants, if inappropriate access may have been allowed to tenant
-          data?
     - id: IAM-11
-      name: User Access Revocation
+      title: User Access Revocation
       specification: Timely de-provisioning (revocation or modification) of user access
         to data and organizationally-owned or managed (physical and virtual) applications,
         infrastructure systems, and network components, shall be implemented as per
@@ -1176,12 +1326,8 @@ ccm:
           to the organizations systems, information assets, and data implemented upon
           any change in status of employees, contractors, customers, business partners,
           or involved third parties?
-      - id: IAM-11.2
-        content: Is any change in user access status intended to include termination
-          of employment, contract or agreement, change of employment or transfer within
-          the organization?
     - id: IAM-12
-      name: User ID Credentials
+      title: User ID Credentials
       specification: |-
         Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
          • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
@@ -1192,24 +1338,6 @@ ccm:
       - id: IAM-12.1
         content: Do you support use of, or integration with, existing customer-based
           Single Sign On (SSO) solutions to your service?
-      - id: IAM-12.2
-        content: Do you use open standards to delegate authentication capabilities
-          to your tenants?
-      - id: IAM-12.3
-        content: Do you support identity federation standards (e.g., SAML, SPML, WS-Federation,
-          etc.) as a means of authenticating/authorizing users?
-      - id: IAM-12.4
-        content: Do you have a Policy Enforcement Point capability (e.g., XACML) to
-          enforce regional legal and policy constraints on user access?
-      - id: IAM-12.5
-        content: Do you have an identity management system (enabling classification
-          of data for a tenant) in place to enable both role-based and context-based
-          entitlement to data?
-      - id: IAM-12.6
-        content: Do you provide tenants with strong (multifactor) authentication options
-          (e.g., digital certs, tokens, biometrics, etc.) for user access?
-      - id: IAM-12.7
-        content: Do you allow tenants to use third-party identity assurance services?
       - id: IAM-12.8
         content: Do you support password (e.g., minimum length, age, history, complexity)
           and account lockout (e.g., lockout threshold, lockout duration) policy enforcement?
@@ -1223,24 +1351,80 @@ ccm:
           been locked out (e.g., self-service via email, defined challenge questions,
           manual unlock)?
     - id: IAM-13
-      name: Utility Programs Access
+      title: Utility Programs Access
       specification: Utility programs capable of potentially overriding system, object,
         network, virtual machine, and application controls shall be restricted.
       questions:
       - id: IAM-13.1
         content: Are utilities that can significantly manage virtualized partitions
           (e.g., shutdown, clone, etc.) appropriately restricted and monitored?
-      - id: IAM-13.2
-        content: Do you have the capability to detect attacks that target the virtual
-          infrastructure directly (e.g., shimming, Blue Pill, Hyper jumping, etc.)?
-      - id: IAM-13.3
-        content: Are attacks that target the virtual infrastructure prevented with
-          technical controls?
+  - id: SA
+    controls:
+    - id: SA-02
+      questions:
+      - id: IAM-12.2
+        content: Do you use open standards to delegate authentication capabilities
+          to your tenants?
+      - id: IAM-12.3
+        content: Do you support identity federation standards (e.g., SAML, SPML, WS-Federation,
+          etc.) as a means of authenticating/authorizing users?
+      - id: IAM-12.4
+        content: Do you have a Policy Enforcement Point capability (e.g., XACML) to
+          enforce regional legal and policy constraints on user access?
+      - id: IAM-12.5
+        content: Do you have an identity management system (enabling classification
+          of data for a tenant) in place to enable both role-based and context-based
+          entitlement to data?
+      - id: IAM-12.6
+        content: Do you provide tenants with strong (multifactor) authentication options
+          (e.g., digital certs, tokens, biometrics, etc.) for user access?
+      - id: IAM-12.7
+        content: Do you allow tenants to use third-party identity assurance services?
+    - id: SA-14
+      questions:
+      - id: IVS-01.2
+        content: Is physical and logical user access to audit logs restricted to authorized
+          personnel?
+      - id: IVS-01.3
+        content: Can you provide evidence that due diligence mapping of regulations
+          and standards to your controls/architecture/processes has been done?
+    - id: SA-06
+      questions:
+      - id: IVS-08.2
+        content: For your IaaS offering, do you provide tenants with guidance on how
+          to create suitable production and test environments?
+    - id: SA-09
+      questions:
+      - id: IVS-09.2
+        content: Are system and network environments protected by a firewall or virtual
+          firewall to ensure compliance with legislative, regulatory, and contractual
+          requirements?
+      - id: IVS-09.3
+        content: Are system and network environments protected by a firewall or virtual
+          firewall to ensure separation of production and non-production environments?
+      - id: IVS-09.4
+        content: Are system and network environments protected by a firewall or virtual
+          firewall to ensure protection and isolation of sensitive data?
+    - id: SA-10
+      questions:
+      - id: IVS-12.2
+        content: Are policies and procedures established and mechanisms implemented
+          to ensure wireless security settings are enabled with strong encryption
+          for authentication and transmission, replacing vendor default settings (e.g.,
+          encryption keys, passwords, SNMP community strings)?
+      - id: IVS-12.3
+        content: Are policies and procedures established and mechanisms implemented
+          to protect wireless network environments and detect the presence of unauthorized
+          (rogue) network devices for a timely disconnect from the network?
+    - id: SA-15
+      questions:
+      - id: TVM-03.2
+        content: Is all unauthorized mobile code prevented from executing?
   - id: IVS
-    name: Infrastructure & Virtualization Security
+    title: Infrastructure & Virtualization Security
     controls:
     - id: IVS-01
-      name: Audit Logging / Intrusion Detection
+      title: Audit Logging / Intrusion Detection
       specification: Higher levels of assurance are required for protection, retention,
         and lifecycle management of audit logs, adhering to applicable legal, statutory,
         or regulatory compliance obligations and providing unique user access accountability
@@ -1252,19 +1436,13 @@ ccm:
         content: Are file integrity (host) and network intrusion detection (IDS) tools
           implemented to help facilitate timely detection, investigation by root cause
           analysis, and response to incidents?
-      - id: IVS-01.2
-        content: Is physical and logical user access to audit logs restricted to authorized
-          personnel?
-      - id: IVS-01.3
-        content: Can you provide evidence that due diligence mapping of regulations
-          and standards to your controls/architecture/processes has been done?
       - id: IVS-01.4
         content: Are audit logs centrally stored and retained?
       - id: IVS-01.5
         content: Are audit logs reviewed on a regular basis for security events (e.g.,
           with automated tools)?
     - id: IVS-02
-      name: Change Detection
+      title: Change Detection
       specification: The provider shall ensure the integrity of all virtual machine
         images at all times. Any changes made to virtual machine images must be logged
         and an alert raised regardless of their running state (e.g., dormant, off,
@@ -1280,7 +1458,7 @@ ccm:
           validation of the image's integrity, made immediately available to customers
           through electronic methods (e.g., portals or alerts)?
     - id: IVS-03
-      name: Clock Synchronization
+      title: Clock Synchronization
       specification: A reliable and mutually agreed upon external time source shall
         be used to synchronize the system clocks of all relevant information processing
         systems to facilitate tracing and reconstitution of activity timelines.
@@ -1289,7 +1467,7 @@ ccm:
         content: Do you use a synchronized time-service protocol (e.g., NTP) to ensure
           all systems have a common time reference?
     - id: IVS-04
-      name: Capacity / Resource Planning
+      title: Capacity / Resource Planning
       specification: The availability, quality, and adequate capacity and resources
         shall be planned, prepared, and measured to deliver the required system performance
         in accordance with legal, statutory, and regulatory compliance obligations.
@@ -1300,9 +1478,6 @@ ccm:
         content: Do you provide documentation regarding what levels of system (e.g.,
           network, storage, memory, I/O, etc.) oversubscription you maintain and under
           what circumstances/scenarios?
-      - id: IVS-04.2
-        content: Do you restrict use of the memory oversubscription capabilities present
-          in the hypervisor?
       - id: IVS-04.3
         content: Do your system capacity requirements take into account current, projected,
           and anticipated capacity needs for all systems used to provide services
@@ -1312,7 +1487,7 @@ ccm:
           meet regulatory, contractual, and business requirements for all the systems
           used to provide services to the tenants?
     - id: IVS-05
-      name: Management - Vulnerability Management
+      title: Management - Vulnerability Management
       specification: Implementers shall ensure that the security vulnerability assessment
         tools or services accommodate the virtualization technologies used (e.g.,
         virtualization aware).
@@ -1321,7 +1496,7 @@ ccm:
         content: Do security vulnerability assessment tools or services accommodate
           the virtualization technologies being used (e.g., virtualization aware)?
     - id: IVS-06
-      name: Network Security
+      title: Network Security
       specification: Network environments and virtual instances shall be designed
         and configured to restrict and monitor traffic between trusted and untrusted
         connections. These configurations shall be reviewed at least annually, and
@@ -1341,7 +1516,7 @@ ccm:
       - id: IVS-06.4
         content: Are all firewall access control lists documented with business justification?
     - id: IVS-07
-      name: OS Hardening and Base Controls
+      title: OS Hardening and Base Controls
       specification: 'Each operating system shall be hardened to provide only necessary
         ports, protocols, and services to meet business needs and have in place supporting
         technical controls such as: antivirus, file integrity monitoring, and logging
@@ -1353,7 +1528,7 @@ ccm:
           (e.g., antivirus, file integrity monitoring, and logging) as part of their
           baseline build standard or template?
     - id: IVS-08
-      name: Production / Non-Production Environments
+      title: Production / Non-Production Environments
       specification: 'Production and non-production environments shall be separated
         to prevent unauthorized access or changes to information assets. Separation
         of the environments may include: stateful inspection firewalls, domain/realm
@@ -1363,14 +1538,11 @@ ccm:
       - id: IVS-08.1
         content: For your SaaS or PaaS offering, do you provide tenants with separate
           environments for production and test processes?
-      - id: IVS-08.2
-        content: For your IaaS offering, do you provide tenants with guidance on how
-          to create suitable production and test environments?
       - id: IVS-08.3
         content: Do you logically and physically segregate production and non-production
           environments?
     - id: IVS-09
-      name: Segmentation
+      title: Segmentation
       specification: |-
         Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed, and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations:
          • Established policies and procedures
@@ -1380,18 +1552,8 @@ ccm:
       - id: IVS-09.1
         content: Are system and network environments protected by a firewall or virtual
           firewall to ensure business and customer security requirements?
-      - id: IVS-09.2
-        content: Are system and network environments protected by a firewall or virtual
-          firewall to ensure compliance with legislative, regulatory, and contractual
-          requirements?
-      - id: IVS-09.3
-        content: Are system and network environments protected by a firewall or virtual
-          firewall to ensure separation of production and non-production environments?
-      - id: IVS-09.4
-        content: Are system and network environments protected by a firewall or virtual
-          firewall to ensure protection and isolation of sensitive data?
     - id: IVS-10
-      name: VM Security - Data Protection
+      title: VM Security - Data Protection
       specification: Secured and encrypted communication channels shall be used when
         migrating physical servers, applications, or data to virtualized servers and,
         where possible, shall use a network segregated from production-level networks
@@ -1404,7 +1566,7 @@ ccm:
         content: Do you use a network segregated from production-level networks when
           migrating physical servers, applications, or data to virtual servers?
     - id: IVS-11
-      name: VMM Security - Hypervisor Hardening
+      title: VMM Security - Hypervisor Hardening
       specification: Access to all hypervisor management functions or administrative
         consoles for systems hosting virtualized systems shall be restricted to personnel
         based upon the principle of least privilege and supported through technical
@@ -1418,7 +1580,7 @@ ccm:
           (e.g., two-factor authentication, audit trails, IP address filtering, firewalls
           and TLS-encapsulated communications to the administrative consoles)?
     - id: IVS-12
-      name: Wireless Security
+      title: Wireless Security
       specification: |-
         Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following:
          • Perimeter firewalls implemented and configured to restrict unauthorized traffic
@@ -1430,17 +1592,8 @@ ccm:
         content: Are policies and procedures established and mechanisms configured
           and implemented to protect the wireless network environment perimeter and
           to restrict unauthorized wireless traffic?
-      - id: IVS-12.2
-        content: Are policies and procedures established and mechanisms implemented
-          to ensure wireless security settings are enabled with strong encryption
-          for authentication and transmission, replacing vendor default settings (e.g.,
-          encryption keys, passwords, SNMP community strings)?
-      - id: IVS-12.3
-        content: Are policies and procedures established and mechanisms implemented
-          to protect wireless network environments and detect the presence of unauthorized
-          (rogue) network devices for a timely disconnect from the network?
     - id: IVS-13
-      name: Network Architecture
+      title: Network Architecture
       specification: Network architecture diagrams shall clearly identify high-risk
         environments and data flows that may have legal compliance impacts. Technical
         measures shall be implemented and shall apply defense-in-depth techniques
@@ -1459,10 +1612,10 @@ ccm:
           or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks)
           and/or distributed denial-of-service (DDoS) attacks?
   - id: IPY
-    name: Interoperability & Portability
+    title: Interoperability & Portability
     controls:
     - id: IPY-01
-      name: APIs
+      title: APIs
       specification: The provider shall use open and published APIs to ensure support
         for interoperability between components and to facilitate migrating applications.
       questions:
@@ -1470,7 +1623,7 @@ ccm:
         content: Do you publish a list of all APIs available in the service and indicate
           which are standard and which are customized?
     - id: IPY-02
-      name: Data Request
+      title: Data Request
       specification: All structured and unstructured data shall be available to the
         customer and provided to them upon request in an industry-standard format
         (e.g., .doc, .xls, .pdf, logs, and flat files).
@@ -1479,7 +1632,7 @@ ccm:
         content: Is unstructured customer data available on request in an industry-standard
           format (e.g., .doc, .xls, or .pdf)?
     - id: IPY-03
-      name: Policy & Legal
+      title: Policy & Legal
       specification: Policies, procedures, and mutually-agreed upon provisions and/or
         terms shall be established to satisfy customer (tenant) requirements for service-to-service
         application (API) and information processing interoperability, and portability
@@ -1494,7 +1647,7 @@ ccm:
         content: Do you provide policies and procedures (i.e. service level agreements)
           governing the migration of application data to and from your service?
     - id: IPY-04
-      name: Standardized Network Protocols
+      title: Standardized Network Protocols
       specification: The provider shall use secure (e.g., non-clear text and authenticated)
         standardized network protocols for the import and export of data and to manage
         the service, and shall make available a document to consumers (tenants) detailing
@@ -1509,7 +1662,7 @@ ccm:
           relevant interoperability and portability network protocol standards that
           are involved?
     - id: IPY-05
-      name: Virtualization
+      title: Virtualization
       specification: The provider shall use an industry-recognized virtualization
         platform and standard virtualization formats (e.g., OVF) to help ensure interoperability,
         and shall have documented custom changes made to any hypervisor in use, and
@@ -1522,10 +1675,10 @@ ccm:
         content: Do you have documented custom changes made to any hypervisor in use,
           and all solution-specific virtualization hooks available for customer review?
   - id: MOS
-    name: Mobile Security
+    title: Mobile Security
     controls:
     - id: MOS-01
-      name: Anti-Malware
+      title: Anti-Malware
       specification: Anti-malware awareness training, specific to mobile devices,
         shall be included in the provider's information security awareness training.
       questions:
@@ -1533,7 +1686,7 @@ ccm:
         content: Do you provide anti-malware training specific to mobile devices as
           part of your information security awareness training?
     - id: MOS-02
-      name: Application Stores
+      title: Application Stores
       specification: A documented list of approved application stores has been communicated
         as acceptable for mobile devices accessing or storing provider managed data.
       questions:
@@ -1542,7 +1695,7 @@ ccm:
           stores for mobile devices accessing or storing company data and/or company
           systems?
     - id: MOS-03
-      name: Approved Applications
+      title: Approved Applications
       specification: The company shall have a documented policy prohibiting the installation
         of non-approved applications or approved applications not obtained through
         a pre-identified application store.
@@ -1552,7 +1705,7 @@ ccm:
           that only approved applications and those from approved application stores
           can be loaded onto a mobile device?
     - id: MOS-04
-      name: Approved Software for BYOD
+      title: Approved Software for BYOD
       specification: The BYOD policy and supporting awareness training clearly states
         the approved applications, application stores, and application extensions
         and plugins that may be used for BYOD usage.
@@ -1561,7 +1714,7 @@ ccm:
         content: Does your BYOD policy and training clearly state which applications
           and applications stores are approved for use on BYOD devices?
     - id: MOS-05
-      name: Awareness and Training
+      title: Awareness and Training
       specification: The provider shall have a documented mobile device policy that
         includes a documented definition for mobile devices and the acceptable usage
         and requirements for all mobile devices. The provider shall post and communicate
@@ -1573,7 +1726,7 @@ ccm:
           that clearly defines mobile devices and the accepted usage and requirements
           for mobile devices?
     - id: MOS-06
-      name: Cloud Based Services
+      title: Cloud Based Services
       specification: All cloud-based services used by the company's mobile devices
         or BYOD shall be pre-approved for usage and the storage of company business
         data.
@@ -1583,7 +1736,7 @@ ccm:
           that are allowed to be used for use and storage of company business data
           via a mobile device?
     - id: MOS-07
-      name: Compatibility
+      title: Compatibility
       specification: The company shall have a documented application validation process
         to test for mobile device, operating system, and application compatibility
         issues.
@@ -1592,7 +1745,7 @@ ccm:
         content: Do you have a documented application validation process for testing
           device, operating system, and application compatibility issues?
     - id: MOS-08
-      name: Device Eligibility
+      title: Device Eligibility
       specification: The BYOD policy shall define the device and eligibility requirements
         to allow for BYOD usage.
       questions:
@@ -1600,7 +1753,7 @@ ccm:
         content: Do you have a BYOD policy that defines the device(s) and eligibility
           requirements allowed for BYOD usage?
     - id: MOS-09
-      name: Device Inventory
+      title: Device Inventory
       specification: An inventory of all mobile devices used to store and access company
         data shall be kept and maintained. All changes to the status of these devices,
         (i.e., operating system and patch levels, lost or decommissioned status, and
@@ -1612,7 +1765,7 @@ ccm:
           company data which includes device status (e.g., operating system and patch
           levels, lost or decommissioned, device assignee)?
     - id: MOS-10
-      name: Device Management
+      title: Device Management
       specification: A centralized, mobile device management solution shall be deployed
         to all mobile devices permitted to store, transmit, or process customer data.
       questions:
@@ -1621,7 +1774,7 @@ ccm:
           to all mobile devices that are permitted to store, transmit, or process
           company data?
     - id: MOS-11
-      name: Encryption
+      title: Encryption
       specification: The mobile device policy shall require the use of encryption
         either for the entire device or for data identified as sensitive on all mobile
         devices and shall be enforced through technology controls.
@@ -1631,7 +1784,7 @@ ccm:
           either the entire device or for data identified as sensitive enforceable
           through technology controls for all mobile devices?
     - id: MOS-12
-      name: Jailbreaking and Rooting
+      title: Jailbreaking and Rooting
       specification: The mobile device policy shall prohibit the circumvention of
         built-in security controls on mobile devices (e.g., jailbreaking or rooting)
         and is enforced through detective and preventative controls on the device
@@ -1645,7 +1798,7 @@ ccm:
           via a centralized device management system which prohibit the circumvention
           of built-in security controls?
     - id: MOS-13
-      name: Legal
+      title: Legal
       specification: The BYOD policy includes clarifying language for the expectation
         of privacy, requirements for litigation, e-discovery, and legal holds. The
         BYOD policy shall clearly state the expectations over the loss of non-company
@@ -1659,7 +1812,7 @@ ccm:
           via a centralized device management system which prohibit the circumvention
           of built-in security controls?
     - id: MOS-14
-      name: Lockout Screen
+      title: Lockout Screen
       specification: BYOD and/or company owned devices are configured to require an
         automatic lockout screen, and the requirement shall be enforced through technical
         controls.
@@ -1668,7 +1821,7 @@ ccm:
         content: Do you require and enforce via technical controls an automatic lockout
           screen for BYOD and company owned devices?
     - id: MOS-15
-      name: Operating Systems
+      title: Operating Systems
       specification: Changes to mobile device operating systems, patch levels, and/or
         applications shall be managed through the company's change management processes.
       questions:
@@ -1676,7 +1829,7 @@ ccm:
         content: Do you manage all changes to mobile device operating systems, patch
           levels, and applications via your company's change management processes?
     - id: MOS-16
-      name: Passwords
+      title: Passwords
       specification: Password policies, applicable to mobile devices, shall be documented
         and enforced through technical controls on all company devices or devices
         approved for BYOD usage, and shall prohibit the changing of password/PIN lengths
@@ -1692,7 +1845,7 @@ ccm:
         content: Do your password policies prohibit the changing of authentication
           requirements (i.e. password/PIN length) via a mobile device?
     - id: MOS-17
-      name: Policy
+      title: Policy
       specification: The mobile device policy shall require the BYOD user to perform
         backups of data, prohibit the usage of unapproved application stores, and
         require the use of anti-malware software (where supported).
@@ -1707,7 +1860,7 @@ ccm:
         content: Do you have a policy that requires BYOD users to use anti-malware
           software (where supported)?
     - id: MOS-18
-      name: Remote Wipe
+      title: Remote Wipe
       specification: All mobile devices permitted for use through the company BYOD
         program or a company-assigned mobile device shall allow for remote wipe by
         the company's corporate IT or shall have all company-provided data wiped by
@@ -1720,7 +1873,7 @@ ccm:
         content: Does your IT provide remote wipe or corporate data wipe for all company-assigned
           mobile devices?
     - id: MOS-19
-      name: Security Patches
+      title: Security Patches
       specification: Mobile devices connecting to corporate networks or storing and
         accessing company information shall allow for remote software version/patch
         validation. All mobile devices shall have the latest available security-related
@@ -1734,7 +1887,7 @@ ccm:
         content: Do your mobile devices allow for remote validation to download the
           latest security patches by company IT personnel?
     - id: MOS-20
-      name: Users
+      title: Users
       specification: The BYOD policy shall clarify the systems and servers allowed
         for use or access on a BYOD-enabled device.
       questions:
@@ -1745,10 +1898,10 @@ ccm:
         content: Does your BYOD policy specify the user roles that are allowed access
           via a BYOD-enabled device?
   - id: SEF
-    name: Security Incident Management, E-Discovery, & Cloud Forensics
+    title: Security Incident Management, E-Discovery, & Cloud Forensics
     controls:
     - id: SEF-01
-      name: Contact / Authority Maintenance
+      title: Contact / Authority Maintenance
       specification: Points of contact for applicable regulation authorities, national
         and local law enforcement, and other legal jurisdictional authorities shall
         be maintained and regularly updated (e.g., change in impacted-scope and/or
@@ -1760,7 +1913,7 @@ ccm:
         content: Do you maintain liaisons and points of contact with local authorities
           in accordance with contracts and appropriate regulations?
     - id: SEF-02
-      name: Incident Management
+      title: Incident Management
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to triage security-related
         events and ensure timely and thorough incident management, as per established
@@ -1768,17 +1921,11 @@ ccm:
       questions:
       - id: SEF-02.1
         content: Do you have a documented security incident response plan?
-      - id: SEF-02.2
-        content: Do you integrate customized tenant requirements into your security
-          incident response plans?
-      - id: SEF-02.3
-        content: Do you publish a roles and responsibilities document specifying what
-          you vs. your tenants are responsible for during security incidents?
       - id: SEF-02.4
         content: Have you tested your security incident response plans in the last
           year?
     - id: SEF-03
-      name: Incident Reporting
+      title: Incident Reporting
       specification: Workforce personnel and external business relationships shall
         be informed of their responsibility and, if required, shall consent and/or
         contractually agree to report all information security events in a timely
@@ -1790,11 +1937,8 @@ ccm:
         content: Does your security information and event management (SIEM) system
           merge data sources (e.g., app logs, firewall logs, IDS logs, physical access
           logs, etc.) for granular analysis and alerting?
-      - id: SEF-03.2
-        content: Does your logging and monitoring framework allow isolation of an
-          incident to specific tenants?
     - id: SEF-04
-      name: Incident Response Legal Preparation
+      title: Incident Response Legal Preparation
       specification: Proper forensic procedures, including chain of custody, are required
         for the presentation of evidence to support potential legal action subject
         to the relevant jurisdiction after an information security incident. Upon
@@ -1805,32 +1949,19 @@ ccm:
       - id: SEF-04.1
         content: Does your incident response plan comply with industry standards for
           legally admissible chain-of-custody management processes and controls?
-      - id: SEF-04.2
-        content: Does your incident response capability include the use of legally
-          admissible forensic data collection and analysis techniques?
-      - id: SEF-04.3
-        content: Are you capable of supporting litigation holds (freeze of data from
-          a specific point in time) for a specific tenant without freezing other tenant
-          data?
-      - id: SEF-04.4
-        content: Do you enforce and attest to tenant data separation when producing
-          data in response to legal subpoenas?
     - id: SEF-05
-      name: Incident Response Metrics
+      title: Incident Response Metrics
       specification: Mechanisms shall be put in place to monitor and quantify the
         types, volumes, and costs of information security incidents.
       questions:
       - id: SEF-05.1
         content: Do you monitor and quantify the types, volumes, and impacts on all
           information security incidents?
-      - id: SEF-05.2
-        content: Will you share statistical information for security incident data
-          with your tenants upon request?
   - id: STA
-    name: Supply Chain Management, Transparency, and Accountability
+    title: Supply Chain Management, Transparency, and Accountability
     controls:
     - id: STA-01
-      name: Data Quality and Integrity
+      title: Data Quality and Integrity
       specification: Providers shall inspect, account for, and work with their cloud
         supply-chain partners to correct data quality errors and associated risks.
         Providers shall design and implement controls to mitigate and contain data
@@ -1845,7 +1976,7 @@ ccm:
           security risks through proper separation of duties, role-based access, and
           least-privileged access for all personnel within your supply chain?
     - id: STA-02
-      name: Incident Reporting
+      title: Incident Reporting
       specification: The provider shall make security incident information available
         to all affected customers and providers periodically through electronic methods
         (e.g., portals).
@@ -1854,7 +1985,7 @@ ccm:
         content: Do you make security incident information available to all affected
           customers and providers periodically through electronic methods (e.g., portals)?
     - id: STA-03
-      name: Network / Infrastructure Services
+      title: Network / Infrastructure Services
       specification: Business-critical or customer (tenant) impacting (physical and
         virtual) application and system-system interface (API) designs and configurations,
         and infrastructure network and systems components, shall be designed, developed,
@@ -1865,10 +1996,8 @@ ccm:
       - id: STA-03.1
         content: Do you collect capacity and use data for all relevant components
           of your cloud service offering?
-      - id: STA-03.2
-        content: Do you provide tenants with capacity planning and use reports?
     - id: STA-04
-      name: Provider Internal Assessments
+      title: Provider Internal Assessments
       specification: The provider shall perform annual internal assessments of conformance
         and effectiveness of its policies, procedures, and supporting measures and
         metrics.
@@ -1877,7 +2006,7 @@ ccm:
         content: Do you perform annual internal assessments of conformance and effectiveness
           of your policies, procedures, and supporting measures and metrics?
     - id: STA-05
-      name: Third Party Agreements
+      title: Third Party Agreements
       specification: |-
         Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms:
          • Scope of business relationship and services offered (e.g., customer (tenant) data acquisition, exchange and usage, feature sets and functionality, personnel and infrastructure network and systems components for service delivery and support, roles and responsibilities of provider and customer (tenant) and any subcontracted or outsourced business relationships, physical geographical location of hosted services, and any known regulatory compliance considerations)
@@ -1891,11 +2020,6 @@ ccm:
       - id: STA-05.1
         content: Do you select and monitor outsourced providers in compliance with
           laws in the country where the data is processed, stored, and transmitted?
-      - id: STA-05.2
-        content: Do you select and monitor outsourced providers in compliance with
-          laws in the country where the data originates?
-      - id: STA-05.3
-        content: Does legal counsel review all third-party agreements?
       - id: STA-05.4
         content: Do third-party agreements include provision for the security and
           protection of information and assets?
@@ -1903,7 +2027,7 @@ ccm:
         content: Do you provide the client with a list and copies of all subprocessing
           agreements and keep this updated?
     - id: STA-06
-      name: Supply Chain Governance Reviews
+      title: Supply Chain Governance Reviews
       specification: Providers shall review the risk management and governance processes
         of their partners so that practices are consistent and aligned to account
         for risks inherited from other members of that partner's cloud supply chain.
@@ -1913,7 +2037,7 @@ ccm:
           to account for risks inherited from other members of that partner's supply
           chain?
     - id: STA-07
-      name: Supply Chain Metrics
+      title: Supply Chain Metrics
       specification: Policies and procedures shall be implemented to ensure the consistent
         review of service agreements (e.g., SLAs) between providers and customers
         (tenants) across the relevant supply chain (upstream/downstream). Reviews
@@ -1935,7 +2059,7 @@ ccm:
       - id: STA-07.4
         content: Do you review all agreements, policies, and processes at least annually?
     - id: STA-08
-      name: Third Party Assessment
+      title: Third Party Assessment
       specification: Providers shall assure reasonable information security across
         their information supply chain by performing an annual review. The review
         shall include all partners/third party providers upon which their information
@@ -1948,7 +2072,7 @@ ccm:
         content: Does your annual review include all partners/third-party providers
           upon which your information supply chain depends?
     - id: STA-09
-      name: Third Party Audits
+      title: Third Party Audits
       specification: Third-party service providers shall demonstrate compliance with
         information security and confidentiality, access control, service definitions,
         and delivery level agreements included in third-party contracts. Third-party
@@ -1960,11 +2084,20 @@ ccm:
       - id: STA-09.2
         content: Do you have external third party services conduct vulnerability scans
           and periodic penetration tests on your applications and networks?
+  - id: LG
+    controls:
+    - id: LG-02
+      questions:
+      - id: STA-05.2
+        content: Do you select and monitor outsourced providers in compliance with
+          laws in the country where the data originates?
+      - id: STA-05.3
+        content: Does legal counsel review all third-party agreements?
   - id: TVM
-    name: Threat and Vulnerability Management
+    title: Threat and Vulnerability Management
     controls:
     - id: TVM-01
-      name: Antivirus / Malicious Software
+      title: Antivirus / Malicious Software
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to prevent the execution
         of malware on organizationally-owned or managed user end-point devices (i.e.,
@@ -1974,12 +2107,8 @@ ccm:
       - id: TVM-01.1
         content: Do you have anti-malware programs that support or connect to your
           cloud service offerings installed on all of your systems?
-      - id: TVM-01.2
-        content: Do you ensure that security threat detection systems using signatures,
-          lists, or behavioral patterns are updated across all infrastructure components
-          within industry accepted time frames?
     - id: TVM-02
-      name: Vulnerability / Patch Management
+      title: Vulnerability / Patch Management
       specification: Policies and procedures shall be established, and supporting
         processes and technical measures implemented, for timely detection of vulnerabilities
         within organizationally-owned or managed applications, infrastructure network
@@ -1996,23 +2125,8 @@ ccm:
       - id: TVM-02.1
         content: Do you conduct network-layer vulnerability scans regularly as prescribed
           by industry best practices?
-      - id: TVM-02.2
-        content: Do you conduct application-layer vulnerability scans regularly as
-          prescribed by industry best practices?
-      - id: TVM-02.3
-        content: Do you conduct local operating system-layer vulnerability scans regularly
-          as prescribed by industry best practices?
-      - id: TVM-02.4
-        content: Will you make the results of vulnerability scans available to tenants
-          at their request?
-      - id: TVM-02.5
-        content: Do you have a capability to rapidly patch vulnerabilities across
-          all of your computing devices, applications, and systems?
-      - id: TVM-02.6
-        content: Will you provide your risk-based systems patching time frames to
-          your tenants upon request?
     - id: TVM-03
-      name: Mobile Code
+      title: Mobile Code
       specification: Policies and procedures shall be established, and supporting
         business processes and technical measures implemented, to prevent the execution
         of unauthorized mobile code, defined as software transferred between systems
@@ -2025,5 +2139,3 @@ ccm:
         content: Is mobile code authorized before its installation and use, and the
           code configuration checked, to ensure that the authorized mobile code operates
           according to a clearly defined security policy?
-      - id: TVM-03.2
-        content: Is all unauthorized mobile code prevented from executing?