CSA STAR: Cloud Security Trust and Assurance Guide

The CSA Security, Trust, Assurance, and Risk (STAR) Registry is the world's most comprehensive cloud security assurance programme. It provides a three-tiered framework for cloud service providers to demonstrate their security posture, building on the Cloud Controls Matrix (CCM) with progressive levels of assurance from self-assessment through continuous monitoring. The STAR Registry is publicly accessible, enabling cloud consumers to evaluate provider security before procurement.

What CSA STAR Covers

CSA STAR operates at three levels. Level 1 (Self-Assessment) requires providers to complete the Consensus Assessments Initiative Questionnaire (CAIQ) documenting their compliance with CCM controls. The completed CAIQ is published on the STAR Registry for public review.

Level 2 provides two paths. STAR Certification combines ISO 27001 certification with additional CCM criteria assessed by a CSA-authorized auditor. STAR Attestation combines SOC 2 attestation with additional CCM criteria. Both provide independent, third-party validation of cloud security controls.

Level 3 (Continuous Monitoring) builds on Level 2 by adding automated, continuous assessment of cloud security controls — providing near-real-time assurance rather than point-in-time certification.

Who Should Pursue CSA STAR

Cloud service providers seeking to differentiate their security posture in a crowded market. CSP customers increasingly check the STAR Registry during vendor evaluation. STAR is particularly valuable for providers competing for enterprise and government contracts where cloud security assurance is a procurement requirement. Over 1,500 cloud providers are listed on the STAR Registry.

Implementation Approach

Start with Level 1 by completing the CAIQ against your cloud security controls. Publish your self-assessment on the STAR Registry. For Level 2, pursue ISO 27001 certification or SOC 2 attestation, then engage a CSA-authorized auditor to assess the additional CCM criteria. Maintain your STAR listing with annual updates and respond to any customer inquiries through the Registry.

Cost Considerations

Level 1 self-assessment is free (STAR Registry listing fee is minimal). Level 2 costs $30,000 to $100,000 on top of the underlying ISO 27001 or SOC 2 engagement, covering the additional CCM assessment by a CSA-authorized auditor. Level 3 continuous monitoring costs are still being established as the market develops. The STAR Registry listing provides significant marketing value as a public, searchable demonstration of cloud security maturity.