Which of the following attestation allows for immediate adoption of the Cloud Control Matrix (CCM) as additional criteria to AICPA Trust Service Criteria and provides the flexibility to update the…

PCI-DSS is a payment card industry data security standard scoped to cardholder data environments and does not provide a mechanism for adopting CCM as additional AICPA-based attestation criteria.

CSA STAR Attestation was specifically designed to layer the Cloud Control Matrix on top of AICPA Trust Services Criteria within a SOC 2 Type 1 or Type 2 examination, enabling cloud-specific control coverage without requiring a separate certification process. Its additional criteria are managed by CSA and can be updated as new cloud technologies emerge or market requirements change, providing a living attestation standard rather than a fixed, immutable control set - a flexibility not offered by the other options listed.

MTCS (Multi-Tier Cloud Security) is a Singapore national standard for cloud service providers and does not integrate CCM as additional AICPA Trust Services Criteria or offer flexibility for market-driven criteria updates.

BSI C5 is a German Federal Office for Information Security cloud compliance catalog that defines its own baseline control set and does not incorporate CCM as additional AICPA Trust Services Criteria.