Two-minute brief
CSA STAR requirements explained: video brief
A two-minute brief on what CSA STAR assesses at each level and the Cloud Controls Matrix that all of them share.
Key takeaways
- STAR Certification is built on ISO/IEC 27001; STAR Attestation on SOC 2.
- Level 1 is a self-assessment published on the STAR Registry.
- The Cloud Controls Matrix v4.1 has 207 controls in 17 domains.
- Matrix controls are mapped to ISO/IEC 27000, NIST and PCI DSS.
- Self-assessments are updated annually.
No management system of its own
CSA STAR does not add a management system of its own. For STAR Certification the system is ISO/IEC 27001: scope, risk assessment and treatment, the Statement of Applicability, internal audit and management review are what the certification body certifies, and the Cloud Controls Matrix is the cloud control catalogue assessed alongside Annex A. For STAR Attestation the base is SOC 2: the AICPA Trust Services Criteria, with the matrix examined as additional criteria. For Level 1 there is no base beyond the provider's own honesty in the questionnaire. This short film lays out the three routes.
At Level 1, the provider completes the Consensus Assessments Initiative Questionnaire against the matrix and CSA publishes it on the STAR Registry, with self-assessments updated annually. At Level 2, STAR Certification is assessed by a Certified STAR Auditor following the ISO/IEC 27001 audit protocol, and STAR Attestation is examined by a CPA firm within a SOC 2 engagement.
The Cloud Controls Matrix all three share
The Cloud Controls Matrix version 4.1, released in January 2026, contains 207 controls in 17 domains, each mapped to the standards buyers already know, including the ISO/IEC 27000 family, NIST and PCI DSS. Its domains run across the areas cloud customers care about, from governance, risk and compliance, audit and assurance and supply chain management to identity and access, data security and privacy, encryption and key management, infrastructure and virtualisation security, logging and monitoring, and security incident management. Submissions against version 4.0 are accepted until December 2027.
CSA STAR is written for cloud service providers of every kind, SaaS, PaaS, IaaS, hosting and managed services, whose enterprise, public-sector or regulated customers ask for a STAR Registry entry or an assessment based on the matrix before they sign.
At Level 1 a provider assesses itself through the CAIQ and CSA publishes the answers; at Level 2 an independent party assesses it, as STAR Certification on an ISO/IEC 27001 audit or STAR Attestation on a SOC 2 examination by a CPA firm. Version 4.1 of the matrix, released in January 2026, is used for new programmes.
CSA STAR at a glance
- Purpose
- A publicly accessible registry, run by the Cloud Security Alliance, of the security and privacy controls of cloud services, with three ways to be listed: a self-assessment, a certification or an attestation, all measured against the Cloud Controls Matrix
- Relevant to
- Cloud service providers of every kind, SaaS, PaaS, IaaS, hosting and managed services, whose enterprise, public-sector or regulated customers ask for a STAR Registry entry or a CCM-based assessment before they sign
- Edition
- Cloud Controls Matrix v4.1, released January 2026, with 207 controls in 17 domains; v4.0 submissions accepted until December 2027. STAR Certification rests on ISO/IEC 27001:2022
- Certification
- Level 2 STAR Certification is assessed and decided by a certification body listed by CSA as a Certified STAR Auditor, following the ISO/IEC 27001 audit protocol; STAR Attestation is examined by a CSA-listed CPA firm as a SOC 2 engagement; Level 1 is your own self-assessment, published by CSA
- Sterling's role
- Implementation with your team, the CCM mapping and shared-responsibility model, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for CSA STAR depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 5 months on an operating ISO/IEC 27001 ISMS, or 6 to 10 months when the ISMS and the Cloud Controls Matrix are implemented together
CSA STAR: questions people ask
What is the difference between STAR Level 1 and Level 2?
At Level 1 you assess yourself: you complete the CAIQ against the Cloud Controls Matrix and CSA publishes your answers, which you update annually. At Level 2 an independent party assesses you: a certification body audits your ISO/IEC 27001 system with the CCM and issues a STAR Certification, or a CPA firm examines your controls against the SOC 2 criteria and the CCM and issues a STAR Attestation. Buyers in regulated or higher-risk settings usually ask for Level 2.
Do we need ISO/IEC 27001 before STAR Certification?
STAR Certification is an ISO/IEC 27001 certification extended with the CCM, so the ISMS is the foundation. You do not have to be certified first: a provider building its first ISMS can have the CCM assessed in the same initial audit, and a provider that already holds the certificate has the CCM added at a surveillance, recertification or dedicated audit. Either way the result follows the ISO/IEC 27001 protocol and expires after three years unless updated.
STAR Certification or STAR Attestation: which one do we need?
It depends on who is asking. Customers in Europe, the Middle East and Asia, and public-sector buyers generally, tend to recognise an ISO-based certificate; US enterprise customers tend to ask for a SOC 2 report. STAR Attestation adds the CCM to the SOC 2 examination and the listing expires after one year; STAR Certification adds it to ISO/IEC 27001 and lasts three years. Providers selling in both markets often hold both, on one control set.
Is there a Level 3, or a continuous option?
CSA's STAR pages and the registry currently describe two levels, and its continuous auditing metrics are published as part of the CCM toolkit rather than as a certification. You will still see a third, continuous-monitoring level referred to by providers and in older articles; plan on Level 1 and Level 2, and ask CSA directly before promising a customer anything beyond them.
Who issues the STAR certificate, and where is it published?
The certification body issues the STAR certificate, following its ISO/IEC 27001 audit, and the CPA firm issues the SOC 2 report behind a STAR Attestation; both must be on CSA's list of Certified STAR Auditors, which separates firms approved for ISO plus CSA STAR Certification from those approved for SOC 2 plus CSA STAR Attestation. You submit the result to CSA, which publishes the entry on the STAR Registry. Sterling prepares you and issues nothing.
Keep exploring
Related to this video
The complete guide
Everything on CSA STAR
Start with the CSA STAR page, or go straight to the guide you need.
On the CSA STAR page
Often combined with CSA STAR
More videos: Information security, cyber and cloud
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
- Cyber Essentials requirements explainedTwo-minute brief · 2 min
- How to comply with the DESC Information Security Regulation (Dubai)Compliance walkthrough · 3 min 15 s
- DESC Information Security Regulation (Dubai) explainedTwo-minute brief · 2 min
- How to implement IEC 62443Implementation walkthrough · 3 min 15 s
- IEC 62443 requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27018Implementation walkthrough · 3 min 15 s
- ISO/IEC 27018 requirements explainedTwo-minute brief · 2 min
- How to comply with the NCA Essential Cybersecurity Controls (Saudi Arabia)Compliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your CSA STAR certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice