Implementation walkthrough
How to implement CSA STAR: video walkthrough
A walkthrough of preparing a cloud service for a CSA STAR Registry entry, from choosing the level and route to the assessment and publication.
Key takeaways
- CSA STAR entries are published on the public STAR Registry.
- Every route is measured against the Cloud Controls Matrix.
- Level 1 is a self-assessment; Level 2 is certification or attestation.
- STAR Certification builds on ISO/IEC 27001; STAR Attestation builds on SOC 2.
- Certified STAR Auditors and CPA firms make the Level 2 decisions.
A public registry of cloud security controls
CSA STAR is the assurance programme of the Cloud Security Alliance, the industry body that publishes the Cloud Controls Matrix. STAR stands for Security, Trust, Assurance and Risk, and its centrepiece is the STAR Registry: a publicly accessible register of the security and privacy controls of cloud services, so that a buyer can read what a provider has assessed, and who assessed it, before sending a questionnaire of its own.
Every entry is measured against the Cloud Controls Matrix, a control framework written for cloud computing and mapped to standards buyers already know, with the Consensus Assessments Initiative Questionnaire built into it. This short film walks through how a provider prepares for a listing.
Choosing the level and the route
The first decision is the level. At Level 1, a provider completes the questionnaire against the matrix itself and publishes it on the registry. At Level 2 there are two routes: STAR Certification, which is an ISO/IEC 27001 certification audit extended with the Cloud Controls Matrix and carried out by a certification body listed by CSA as a Certified STAR Auditor, and STAR Attestation, in which the matrix is examined as additional criteria within a SOC 2 examination by a CPA firm.
For STAR Certification, an organisation that already holds ISO/IEC 27001 adds the matrix to its information security management system and has it assessed at the next surveillance or recertification visit or at a dedicated audit; one that does not builds the system and the matrix together for one two-stage initial audit. For STAR Attestation the same control set goes into the SOC 2 examination. In every case the certification body or the CPA firm assesses, decides and issues, and the provider submits the result to the registry.
Sterling's expert and experienced consultants design, implement and prepare the controls under Sterling OS™. The Cloud Controls Matrix is currently at version 4.1, and STAR Certification rests on ISO/IEC 27001:2022.
CSA STAR at a glance
- Purpose
- A publicly accessible registry, run by the Cloud Security Alliance, of the security and privacy controls of cloud services, with three ways to be listed: a self-assessment, a certification or an attestation, all measured against the Cloud Controls Matrix
- Relevant to
- Cloud service providers of every kind, SaaS, PaaS, IaaS, hosting and managed services, whose enterprise, public-sector or regulated customers ask for a STAR Registry entry or a CCM-based assessment before they sign
- Edition
- Cloud Controls Matrix v4.1, released January 2026, with 207 controls in 17 domains; v4.0 submissions accepted until December 2027. STAR Certification rests on ISO/IEC 27001:2022
- Certification
- Level 2 STAR Certification is assessed and decided by a certification body listed by CSA as a Certified STAR Auditor, following the ISO/IEC 27001 audit protocol; STAR Attestation is examined by a CSA-listed CPA firm as a SOC 2 engagement; Level 1 is your own self-assessment, published by CSA
- Sterling's role
- Implementation with your team, the CCM mapping and shared-responsibility model, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for CSA STAR depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 5 months on an operating ISO/IEC 27001 ISMS, or 6 to 10 months when the ISMS and the Cloud Controls Matrix are implemented together
CSA STAR: questions people ask
What is the difference between STAR Level 1 and Level 2?
At Level 1 you assess yourself: you complete the CAIQ against the Cloud Controls Matrix and CSA publishes your answers, which you update annually. At Level 2 an independent party assesses you: a certification body audits your ISO/IEC 27001 system with the CCM and issues a STAR Certification, or a CPA firm examines your controls against the SOC 2 criteria and the CCM and issues a STAR Attestation. Buyers in regulated or higher-risk settings usually ask for Level 2.
Do we need ISO/IEC 27001 before STAR Certification?
STAR Certification is an ISO/IEC 27001 certification extended with the CCM, so the ISMS is the foundation. You do not have to be certified first: a provider building its first ISMS can have the CCM assessed in the same initial audit, and a provider that already holds the certificate has the CCM added at a surveillance, recertification or dedicated audit. Either way the result follows the ISO/IEC 27001 protocol and expires after three years unless updated.
STAR Certification or STAR Attestation: which one do we need?
It depends on who is asking. Customers in Europe, the Middle East and Asia, and public-sector buyers generally, tend to recognise an ISO-based certificate; US enterprise customers tend to ask for a SOC 2 report. STAR Attestation adds the CCM to the SOC 2 examination and the listing expires after one year; STAR Certification adds it to ISO/IEC 27001 and lasts three years. Providers selling in both markets often hold both, on one control set.
Is there a Level 3, or a continuous option?
CSA's STAR pages and the registry currently describe two levels, and its continuous auditing metrics are published as part of the CCM toolkit rather than as a certification. You will still see a third, continuous-monitoring level referred to by providers and in older articles; plan on Level 1 and Level 2, and ask CSA directly before promising a customer anything beyond them.
Who issues the STAR certificate, and where is it published?
The certification body issues the STAR certificate, following its ISO/IEC 27001 audit, and the CPA firm issues the SOC 2 report behind a STAR Attestation; both must be on CSA's list of Certified STAR Auditors, which separates firms approved for ISO plus CSA STAR Certification from those approved for SOC 2 plus CSA STAR Attestation. You submit the result to CSA, which publishes the entry on the STAR Registry. Sterling prepares you and issues nothing.
Keep exploring
Related to this video
The complete guide
Everything on CSA STAR
Start with the CSA STAR page, or go straight to the guide you need.
On the CSA STAR page
Often combined with CSA STAR
More videos: Information security, cyber and cloud
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
- Cyber Essentials requirements explainedTwo-minute brief · 2 min
- How to comply with the DESC Information Security Regulation (Dubai)Compliance walkthrough · 3 min 15 s
- DESC Information Security Regulation (Dubai) explainedTwo-minute brief · 2 min
- How to implement IEC 62443Implementation walkthrough · 3 min 15 s
- IEC 62443 requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27018Implementation walkthrough · 3 min 15 s
- ISO/IEC 27018 requirements explainedTwo-minute brief · 2 min
- How to comply with the NCA Essential Cybersecurity Controls (Saudi Arabia)Compliance walkthrough · 3 min 15 s
Talk to a consultant
Plan your CSA STAR certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice