CSA STAR — Security, Trust, Assurance, and Risk Program

Why does it matter?

STAR turns a cloud provider's security claims into a public record that a customer can check. A listing shows which assurance level the provider reached and against which version of the CCM, so one registry entry can answer the questions that would otherwise arrive as separate customer questionnaires.

Key benefits include:

• One registry, fewer questionnaires

Providers publish once to the STAR Registry and customers read the entry, which CSA says reduces the need to fill out multiple customer questionnaires.

• Two assurance levels

Level 1 is a self-assessment for lower-risk environments; Level 2 adds a third-party audit for medium and high risk environments, so buyers can match the evidence to their own risk.

• Built on audits providers already run

Level 2 reuses ISO/IEC 27001 certification or a SOC 2 engagement and adds the cloud-specific CCM controls on top.

• A public control baseline

The CCM v4.1 sets out 207 controls across 17 security domains that any provider can implement and any customer can reference.

• A dated version trail

Each entry names the CCM version it was assessed against, which tells a customer how current the assurance is.

How does it work?

The program is organized around three components. The CCM is the control framework, the CAIQ is the yes/no questionnaire derived from it, and the STAR Registry is the public listing where submissions appear. CCM v4.1 has 207 controls in 17 domains, and CAIQ v4.1 has 283 questions.

A provider starts at Level 1 by completing the CAIQ and submitting it. Self-assessments are updated annually. To reach Level 2 it adds an audit: STAR Certification, in which a certification body assesses the ISO/IEC 27001 management system together with the CCM, or STAR Attestation, in which a CPA firm performs a SOC 2 engagement using the CCM. A STAR for AI track, based on the AI Controls Matrix and ISO/IEC 42001, runs alongside.

Certification certificates follow normal ISO/IEC 27001 rules and expire after three years unless updated. Attestation listings expire after one year unless updated. Providers in the Greater China market can use C-STAR, which combines GB/T 22080-2008 with the CCM.

Key Elements

• Cloud Controls Matrix

The control framework behind every level: 207 controls across 17 domains in v4.1, with 11 new controls in areas such as logging and monitoring, incident management, supply chain and threat management.

• CAIQ

The Consensus Assessments Initiative Questionnaire. The STAR Level 1 version of CAIQ v4.1 is the one that can be submitted; the version bundled with the CCM is for reference only.

• STAR Level 1: self-assessment

A provider documents its controls by submitting the CAIQ. It is free, updated annually, and suited to lower-risk environments. Valid-AI-ted is an optional automated validation that adds a badge to the listing.

• STAR Level 2: certification and attestation

Third-party audit. STAR Certification pairs ISO/IEC 27001 with the CCM. STAR Attestation pairs a SOC 2 engagement with the CCM. C-STAR serves the Greater China market. CSA corporate members receive a price reduction.

• STAR for AI

Extends the program to AI services. Organizations submit an AI-CAIQ for Level 1, and since 20 November 2025 can combine an AI-CAIQ with an ISO/IEC 42001 certification for Level 2.

• Transition timeline

CCM v4.1 and CAIQ v4.1 were released in January 2026 and the registry accepted both v4.0 and v4.1 from March 2026. All new submissions use v4.1 after December 2027, and v4.0 is withdrawn in January 2028.

What does it cover?

CSA STAR applies to cloud service providers of any size, in any country, that want to publish assurance about a cloud offering, and to the customers, assessors and certification bodies that rely on those listings. It covers the security and privacy controls of the cloud service named in the listing. It does not certify a whole company, and a Level 1 self-assessment is not an independent audit.

What are its objectives?

CSA STAR gives cloud providers and their customers a common way to publish and read cloud security assurance.

Publish the security and privacy controls of a cloud service in a public registry.

Base every assessment on one control set, the CCM, and one questionnaire, the CAIQ.

Offer graduated assurance: self-assessment at Level 1, independent audit at Level 2.

Let providers reuse ISO/IEC 27001 certification or a SOC 2 engagement for the audit level.

Keep listings current through annual updates, expiry dates and CCM version transitions.

Framework in Context

STAR sits on top of other assurance work rather than replacing it. Level 2 depends on ISO/IEC 27001 for certification and on SOC 2 for attestation, and the CCM v4.1 carries mappings to other standards, including NIST SP 800-171 Rev. 2 and a DORA reverse mapping. It is cloud-specific: general security frameworks do not require a registry entry, and a STAR listing does not replace a customer's own contract review.

Common Framework Mappings

Organizations map CSA STAR to these frameworks to align cloud-specific controls with enterprise security, privacy, and assurance programs, enabling integrated audits, simplified compliance, and consistent risk and governance alignment.

Mapped frameworks include:

Cloud Controls Matrix (CSA CCM)

ISO/IEC 27001

ISO/IEC 27017

ISO/IEC 27018

ISO/IEC 27701

NIST Cybersecurity Framework

NIST SP 800-53

SOC 2