CSA STAR
Certification
Prepare for the CSA STAR cloud assurance programme. We help you assess controls, gather evidence, and get ready for the relevant assessment.
Overview
Cloud security assurance, demonstrated.
We help you complete the CCM-based self-assessment (Level 1), prepare for third-party certification or attestation (Level 2), and lay the groundwork for continuous monitoring. Because STAR maps closely to ISO 27001 and SOC 2, we deliver it efficiently alongside those.
Scope
What we deliver.
CCM-based assurance for cloud providers, at the right STAR level.
- Cloud Controls Matrix (CCM) mapping
- CAIQ self-assessment (Level 1)
- Gap analysis & remediation
- Third-party audit prep (Level 2)
- Continuous-monitoring readiness
- Mapping to ISO 27001 / SOC 2
- Policies & evidence
- STAR registry submission
FAQ
CSA STAR FAQ
Scope, cost, and what happens next.
How much does CSA STAR cost?
CSA STAR support is project-based and depends on the STAR level and your existing certifications. It is most cost-effective alongside ISO 27001 or SOC 2. Contact us for a tailored quote.
What are the CSA STAR levels?
Level 1 is a self-assessment based on the CAIQ. Level 2 is a third-party certification or attestation. Level 3 adds continuous monitoring.
How does CSA STAR relate to ISO 27001?
STAR Level 2 can build on an ISO 27001 certificate (STAR Certification) or a SOC 2 report (STAR Attestation). If you hold one already, STAR is far quicker.
Who should pursue CSA STAR?
Cloud service providers that want to demonstrate security and transparency and appear in the public STAR registry during procurement.
What is the Cloud Controls Matrix?
The CCM is the CSA’s cloud-specific control framework; the STAR self-assessment (CAIQ) maps your controls against it.
Do we need ISO 27001 first?
Not necessarily, but STAR Level 2 builds directly on ISO 27001 or SOC 2; if you hold one, STAR is much faster.
More questions about this service
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire — the self-assessment that maps your controls to the Cloud Controls Matrix for STAR Level 1.
Is STAR Level 1 free to publish?
Level 1 is a self-assessment listed in the public STAR registry; we help you complete it accurately.
Who should pursue CSA STAR?
Cloud service providers that want to demonstrate transparency and security maturity during procurement.
How long does STAR take?
Level 1 can be quick; Level 2 timing depends on whether you already hold ISO 27001 or SOC 2.
Related services
Explore more.
Ready for CSA STAR?
A 30-minute scoping call costs nothing. A lost cloud deal costs considerably more.
Book a short call Send an email