An organization deploying the Cloud Control Matrix (CCM) to perform a compliance assessment will encompass the use of the "Corporate Governance Relevance" feature to filter out those controls:

Question

Options

• Arelating to policies, processes, laws, regulations, and institutions conditioning the way an
• Bthat can be either of a management or of a legal nature, therefore requiring an approval from the
• Cthat require the prior approval from the Board of Directors to be funded (for either make or buy),
• Dthat can be either of an administrative or of a technical nature, therefore requiring an approval from

• A
  88% (30)
• B
  6% (2)
• C
  3% (1)
• D
  3% (1)

Explanation

Option A correctly defines the scope of the Corporate Governance Relevance feature in the CSA Cloud Control Matrix. Corporate governance, by definition, encompasses the policies, processes, laws, regulations, and institutions that condition how an organization is directed and controlled - so filtering on this basis means isolating controls tied to these governance-level elements, which helps organizations determine which CCM controls are relevant to their governance obligations.

Options B and D are incorrect because they describe a management/legal or administrative/technical distinction requiring board approval, which conflates governance relevance with approval workflows - those are operational concerns unrelated to how governance relevance filters controls. Option C is wrong because it introduces a funding/approval mechanism (make-or-buy decisions requiring board sign-off), which is a procurement or CapEx governance concept, not the purpose of the Corporate Governance Relevance metadata field in CCM.

Memory tip: Think of "Corporate Governance" using the classic governance triangle - policies, laws, and institutions. If you associate Corporate Governance Relevance with "who governs the organization externally and internally through rules," you'll immediately recognize option A as the only definition that matches that foundational concept.

No community discussion yet for this question.