CCM: A company wants to use the IaaS offering of some CSP. Which of the following options for using CCM is NOT suitable for the company as a cloud customer?

Submitting the CCM assessment to the CSA STAR registry is the sole responsibility of the CSP, not the cloud customer. The STAR registry is a publicly accessible registry where CSPs self-publish their security and compliance posture. A cloud customer has no authority or standing to submit documentation to STAR on a CSP's behalf.

Building a detailed list of requirements and controls to present to a CSP is a valid and intended use of CCM for cloud customers during vendor evaluation and procurement.

Using CCM to assess the risk of a CSP is a core intended use case for cloud customers, as the matrix provides a structured control framework for evaluating provider security.

This is incorrect because option A is genuinely not suitable for a cloud customer, meaning at least one answer qualifies and 'None of the above' does not apply.