You sell a cloud service, and every enterprise prospect sends you a security questionnaire, often the CAIQ itself. CSA STAR lets you publish your answers in a public registry and, at Level 2, back them with independent third-party assurance. Readiness makes your Cloud Controls Matrix responses accurate and defensible and prepares the evidence an auditor will test, so your listing helps close deals instead of raising new questions.
CSA STAR, short for Security, Trust, Assurance and Risk, is the Cloud Security Alliance’s assurance program for cloud service providers. It is built on the Cloud Controls Matrix (CCM), a cloud-specific control framework that in version 4 contains 197 control objectives across 17 domains, from application and interface security and identity and access management to supply chain management, transparency and accountability. The Consensus Assessments Initiative Questionnaire (CAIQ) turns those controls into questions with room for explanation, and it is the questionnaire many enterprise buyers send to cloud vendors.
STAR has levels. At Level 1 you complete a self-assessment using the CAIQ and publish it in the public STAR Registry, where any prospect can read it. At Level 2 an independent third party assesses you against the CCM in combination with an established standard: STAR Certification is performed alongside ISO/IEC 27001 by an accredited certification body, and STAR Attestation is performed alongside a SOC 2 examination by a CPA firm, with the CCM included as additional criteria.
Teams come to STAR because it answers the cloud-specific questions that ISO 27001 and SOC 2 leave general: who owns which control under the shared security responsibility model, how tenants are isolated, how encryption keys are managed, and how customer data is located, retained and deleted. A registry entry also cuts questionnaire volume, because many buyers will accept a link to your STAR listing instead of sending their own spreadsheet.
Your security team answers the same cloud questions for every prospect. A reviewed CAIQ in the STAR Registry gives buyers one authoritative answer and gives your team back the time spent on spreadsheets.
STAR Level 2 builds on those audits rather than replacing them. Readiness maps the CCM to the controls you already have and closes the cloud-specific gaps so they can be assessed together with your existing audit.
Your customers build on top of you, so they need to know exactly where your responsibility stops and theirs begins. The CCM’s shared security responsibility guidance gives you a structured, public way to say so.
A Level 1 entry is a credible, public first step before you commission a third-party audit. Readiness makes sure it is accurate, because buyers read it and will hold you to it.
The Cloud Security Alliance publishes your Level 1 self-assessment; Level 2 comes from an accredited certification body (STAR Certification) or a CPA firm (STAR Attestation) that you choose
STAR Registry listing at Level 1; STAR Certification or STAR Attestation at Level 2
At Level 1 the answers are yours, and readiness is about making them accurate and supportable. At Level 2 the independent auditor you choose forms the opinion; we prepare you for it and stay on your side of the table.
Every CCM v4 control objective assessed against your current controls and evidence, with gaps ranked by how likely buyers and auditors are to question them.
Answers that are accurate, consistently worded and backed by evidence you can produce on request, with no optimistic “yes” a prospect could later disprove.
A control-by-control statement of what you own, what your cloud providers own and what your customers must do, suitable for publishing to customers.
A crosswalk from the CCM to your existing Statement of Applicability or SOC 2 control set, showing what your current audit already covers and what Level 2 adds.
Revisions to your policies for the cloud-specific areas the CCM expects, such as key management, tenant isolation, data location and portability.
Each gap with a recommended fix and owner, ordered so the issues most visible in your registry entry and most likely to surface in an audit are closed first.
A map from each in-scope CCM control to the record that proves it, organized for the certification body or CPA firm you choose.
Better found now, by people on your side, than by your assessor.
CAIQ answers marked “yes” for controls that exist for only part of the platform, or only on paper
Customer responsibilities undocumented, so buyers assume you own controls you do not
Tenant isolation asserted but never tested or evidenced
Encryption key ownership, rotation and destruction undocumented
Data location and deletion commitments in contracts that the platform cannot demonstrate
Sub-processors and underlying cloud providers left outside supply chain controls
A registry entry that no longer reflects the current product or the current CCM version
Application and interface security controls, and cross-tenant data access in particular, are what buyers reading your STAR entry most want to see evidenced.
What the test coversThe CCM expects APIs to be designed, tested and protected to the same standard as the application; an API test evidences those controls directly.
What the test coversThe CCM’s infrastructure, identity, encryption and logging domains map closely to the configuration of the cloud accounts your service runs in.
What the test coversInfrastructure and virtualization security controls call for segmentation between tenants and environments; testing shows the isolation holds.
What the test coversThreat and vulnerability management controls expect regular detection and remediation of vulnerabilities, with records an auditor can sample.
What the test coversOften, yes. A Level 1 self-assessment is public, uses the questionnaire many buyers already send, and lets you answer once instead of repeatedly. Its weakness is that it is self-declared, so its value depends entirely on accuracy. An entry that overstates your controls invites harder questions and can damage trust when a buyer’s own review contradicts it.
Both are Level 2 third-party assessments against the CCM. STAR Certification is performed by an accredited certification body together with an ISO/IEC 27001 certification audit. STAR Attestation is performed by a CPA firm as part of a SOC 2 examination, with the CCM as additional criteria. Most providers choose the route that matches the audit their customers already ask for.
Yes, that is how Level 2 is designed. Much of the CCM overlaps with ISO 27001 Annex A and the Trust Services Criteria, so the work is mostly identifying the cloud-specific controls your current audit does not test, closing those gaps and documenting them so the auditor can include the CCM in the same engagement.
The STAR Registry is public. Anyone, including prospects, competitors and your existing customers, can read your published self-assessment and see your Level 2 status. Write every answer expecting a buyer’s security team to compare it with your contracts, your trust center and what they find in their own review.
For STAR Certification, a certification body accredited for ISO/IEC 27001 whose auditors meet CSA’s requirements for STAR audits. For STAR Attestation, a CPA firm performing a SOC 2 examination. In both cases you choose the firm, and independence rules keep it from designing the controls it then assesses, which is why readiness sits with a separate party on your side of the table.
CSA has published an AI Controls Matrix that extends the CCM approach to AI systems and has been bringing AI assurance into the STAR program. If your cloud service includes AI features, readiness can consider those controls alongside the CCM, and ISO/IEC 42001 offers a certifiable management system for the AI side of your service.
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.
Not sure where to start? One of our testers reviews your internet-facing footprint and sends you a short summary of what an attacker would see — free. Nothing you don’t own is ever touched, and there’s no sales sequence.
Free. No obligation.
