The Adobe Common Controls Framework (CCF)
We believe that a sound compliance and risk management strategy is as important to the success of an organization as the company’s product strategy. Adobe demonstrates our commitment to security by implementing a range of important industry standards and complying with government regulations concerning the security and privacy of data. As new security standards and regulatory requirements are developed and adopted by the industry, Adobe reviews them and adopts those with relevance to our customers.
To support our ongoing compliance efforts, Adobe implemented an open-source framework of security processes and controls called the Common Controls Framework (CCF). CCF helps protect Adobe infrastructure, applications and services, as well as helps us comply with a number of industry-accepted best practices, standards, regulations and certifications. In creating the CCF, Adobe analyzed the criteria for the most common security certifications for cloud-based businesses and rationalized the more than 4,300 requirements down to Adobe-specific controls that map to 21 industry standards.
This funnel diagram shows the security standards and control requirements Adobe has rationalized to create common controls across various control domains.
The left side of the diagram is titled 20+ Standards, approximately 4300 Control Requirements (CRs). Under the title is the following list of standards, each with by a number representing control requirements:
• AICPA Trust Service Principles Service Organization Controls (SOC) – 40
• Cloud Computing Compliance Criteria Catalogue (BSI C5) – 120
• Cyber Essentials, UK -24
• Critical Security Controls (CIS V8) – 150
• FedRAMP Tailored & Moderate – 320
• Financial Security Institute CSP Evaluation, Korea - 56
• Health Insurance Portability and Accountability Act (HIPAA) – 70
• InfoSec Registered Assessors Program, Australia (IRAP) – 880
• Information System Security Management and Assessment Program, Japan (ISMAP) - 1160
• ISO 27001:2022 & 27002:2022 – 110
• ISO 27017:2015 – 7
• ISO 27018:2019 – 26
• ISO 22301:2019 – 200
• Monetary Authority of Singapore (MAS) – 230
• Multi-Layer Protection Scheme, China (MLPS) – 300
• NIST Cybersecurity - 100
• Payment Card Industry Data Security Standard (PCI DSS v4) – 290
• Spain Esquema Nacional de Seguridad (ENS) – 100
• TXRAMP L1 - 120
The centre of the diagram shows a funnel labelled CCF Rationalization. The standards and controls listed on the left side of the graphic are represented by few yellow dots moving into the funnel. Few green dots are emerging from the funnel on the right side of the graphic. They represent the resulting common controls.
The right side of the diagram is titled Approximately 315 common controls across 25 control domains. Under the title is the following list of control domains, each with a number representing common controls:
• Asset Management – 11 Controls
• Backup Management – 5 Controls
• Business Continuity – 6 Controls
• Change Management – 4 Controls
• Configuration Management – 15 Controls
• Cryptography – 15 Controls
• Customer Managed Security – 4 Controls
• Data Management – 21 Controls
• Entity Management – 11 Controls
• Identity and Access Management – 39 Controls
• Incident Response – 8 Controls
• Mobile Device Management – 4 Controls
• Network Operations – 18 Controls
• People Resources – 10 Controls
• Privacy – 10 Controls
• Proactive Security – 4 Controls
• Risk Management – 8 Controls
• Security Governance – 17 Controls
• Service Lifecycle – 7 Controls
• Site Operations – 16 Controls
• System Design Documentation – 2 Controls
• Systems Monitoring– 32 Controls
• Third Party Management – 13 Controls
• Training and Awareness – 9 Controls
• Vulnerability Management – 23 Controls
Our Ongoing Efforts
Compliance is a continuous process that includes periodic internal audits, external assessments and continuous controls monitoring. Adobe is subjected to regular third-party audits and periodic reviews to ensure we consistently meet commitments. Adobe has also invested in developing an enterprise-wide governance, risk, and compliance (GRC) automation platform to help maintain an effective governance model for the compliance program.
Open-source and Ready to Use
The Common Controls Framework (CCF) has been open sourced (now at version 5.0) to help the broader security and risk management community achieve their own compliance goals. We regularly update the framework as regulations evolve or new industry standards are integrated into our compliance regime. We invite you to use this framework to help accelerate and standardize your own ongoing compliance efforts. Download CCF today and we always welcome feedback on its development.