ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
Description
2
This document is an addendum to the 'CCMv4.0' that contains controls mapping between the CSA CCM v4.0 and the 'Digital Operational Resilience Act (DORA)'. The document aims to help 'CCMv4.0' compliant organizations meet DORA requirements. This is achieved by identifying compliance gaps in 'CCMv4.0' in relation to the DORA. This document contains the following information:
• Controls Mapping
• Gap Identification (i.e. Partial, Full or No Gap)
• Gap Analysis

The document is structured as follows. The tab 'DORA-CCM Mapping' contains the mappings as well as associated information such as the gap analysis and compensating controls. In this tab, columns:
• A-E contain the CCMv4.0 domains and control specifications.
• F-J contain the results of the mapping and gap analysis exercise.
• K-O contain the views of a 2nd reviewer based on the results of the 1st mapping and gap analysis.

The "Terminology" tab provides a list of terms used in this document and their definitions.

The CSA and the CCM working group hope that organizations will find this document useful for their cloud security compliance programs.
The contents of this document could contain technical inaccuracies, typographical errors and out-of-date information.

If you would like to volunteer in the working group, please sign up here.
3
AcknowledgementsEmails
4
Contributors
5
Luis Miguel Barron
Robin Basham
Alla Berg
Arvind Bhat
Anunay Bhatt
Geoff Bird
Alicia Blackett
Marcelo Delima
Ricardo Ferreira
Larisa Gabudeanu
Martin Giguere
Blake Hyatt
Joel John
David Jones
Ahmed Kamel
Paul Lambert
Prachi Naik
Onkar Nath
Nelson Pillajo Casillas
Michael Roza
Sedat Salman
Albert Seshie
Catalin Tiganila
Guido Uglietti		luis.miguel.barron@gmail.com
robin@enterprisegrc.com
alla.berg@kfw.de
bhat.aravind88@gmail.com
anunay007@gmail.com
geoffMBird@hotmail.com
ablackett@rootsoftrust.com
marcelo.delima@thalesgroup.com
ricardo.sff@gmail.com
larisagabudeanu@gmail.com
zefrench@gmail.com
blakehyatt@pm.me
joeljohn268@gmail.com
djones@fsisac.com
ahmed.ma.kamel@gmail.com
lambertp@tcd.ie
prachinaik565@gmail.com
dronkar@yahoo.com
nelosojn1@gmail.com
michael.e.roza@gmail.com
sdtslmn@gmail.com
kofiseshie@gmail.com
ctiganila@cyberowl.lu
Guido.Uglietti@avaloq.com
6
CSA Staff
7
Lefteris Skoutaris (eskoutaris@cloudsecurityalliance.org)
8
9
10
Change Log
11
DateVersionNotes
12
dd/mm/yyyy1Publication of first version of the CCM v4.0 addendum.
13
14
15
© Copyright 2025, Cloud Security Alliance. All rights reserved
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100