Home / Security Compliance / CSA STAR

CSA STAR
Certification

Support for cloud service providers pursuing the Cloud Security Alliance STAR programme — Cloud Controls Matrix self-assessment, third-party audit preparation, and continuous-monitoring readiness.

Pricing Contact us Book a call
Overview

Cloud security assurance, demonstrated.

CSA STAR is the leading assurance programme for cloud service providers, built on the Cloud Controls Matrix (CCM). Listing in the STAR registry signals transparency and security maturity to cloud customers.

We help you complete the CCM-based self-assessment (Level 1), prepare for third-party certification or attestation (Level 2), and lay the groundwork for continuous monitoring. Because STAR maps closely to ISO 27001 and SOC 2, we deliver it efficiently alongside those.

Scope

What we deliver.

CCM-based assurance for cloud providers, at the right STAR level.

Framework: CSA STAR Cloud Controls Matrix CAIQ ISO 27001 mapping
FAQ

CSA STAR FAQ

The questions we're asked most about scope, cost, and timing.

How much does CSA STAR cost?
CSA STAR support is project-based and depends on the STAR level and your existing certifications. It is most cost-effective alongside ISO 27001 or SOC 2. Contact us for a tailored quote.
What are the CSA STAR levels?
Level 1 is a self-assessment based on the CAIQ. Level 2 is a third-party certification or attestation. Level 3 adds continuous monitoring.
How does CSA STAR relate to ISO 27001?
STAR Level 2 can build on an ISO 27001 certificate (STAR Certification) or a SOC 2 report (STAR Attestation). If you hold one already, STAR is far quicker.
Who should pursue CSA STAR?
Cloud service providers that want to demonstrate security and transparency and appear in the public STAR registry during procurement.
What is the Cloud Controls Matrix?
The CCM is the CSA’s cloud-specific control framework; the STAR self-assessment (CAIQ) maps your controls against it.
Do we need ISO 27001 first?
Not necessarily, but STAR Level 2 builds directly on ISO 27001 or SOC 2; if you hold one, STAR is much faster.
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire — the self-assessment that maps your controls to the Cloud Controls Matrix for STAR Level 1.
Is STAR Level 1 free to publish?
Level 1 is a self-assessment listed in the public STAR registry; we help you complete it accurately.
Who should pursue CSA STAR?
Cloud service providers that want to demonstrate transparency and security maturity during procurement.
How long does STAR take?
Level 1 can be quick; Level 2 timing depends on whether you already hold ISO 27001 or SOC 2.
Related services

Explore more.

Parent serviceSecurity Compliance→ RelatedISO 27001→ RelatedSOC 2→ RelatedCloud Security Assessment→

Ready for CSA STAR?

A 30-minute scoping call costs nothing. A lost cloud deal costs considerably more.

Book a meeting Send an email