CCM: A company wants to use the IaaS offering of some CSP.

Submit the CCM on behalf of the CSP to CSA Security, Trust & Assurance Registry (STAR), a free, publicly accessible registry that documents the security controls provided by CSPs

Use CCM to build a detailed list of requirements and controls that they want their CSP to implement

Use CCM to help assess the risk associated with the CSP

None of the above