Organizations can use the CCM to define and identify policies and technical requirements. Using these defined policies and requirements, they can control goals and objectives that will be included in their security program. With clear objectives, organizations can then enforce specific directives related to users and employees, other organizations, and cloud service providers, and can better comply with external regulations.