CSA STAR · Security, Trust, Assurance and Risk registry for cloud services
CSA STAR certification consulting for cloud assurance your clients can look up on a public registry.
Get your cloud service listed on the Cloud Security Alliance's STAR Registry at Level 2: a STAR Certification issued by a CSA-listed certification body on your ISO/IEC 27001 system and the Cloud Controls Matrix, or a STAR Attestation from a CSA-listed CPA firm on your SOC 2 examination. Sterling's expert and experienced consultants map your controls to the matrix, agree the shared responsibilities, close the gaps, prepare the evidence and stay with you through the audit and the registry submission, in 60+ countries. We ensure successful certification for our clients.
- One all-inclusive proposal for a defined scope: consulting, Effivity software, Sterling Academy access, vulnerability assessment and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cloud security consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; the certification body or CPA firm assesses and decides
8,100+ client engagements in 60+ countries.
CSA STAR client experience
What it is
What is CSA STAR and what is it used for?
CSA STAR is the assurance programme of the Cloud Security Alliance, the industry body that publishes the Cloud Controls Matrix (CCM). STAR stands for Security, Trust, Assurance and Risk, and its centrepiece is the STAR Registry: a publicly accessible register that documents the security and privacy controls of cloud services, so that a buyer can read what a provider has assessed, and who assessed it, before sending a questionnaire of their own. Every entry is measured against the CCM, a control framework written for cloud computing: 207 controls in 17 domains in version 4.1, each mapped to the standards buyers already know, including the ISO/IEC 27000 family, NIST and PCI DSS, with a yes/no questionnaire, the Consensus Assessments Initiative Questionnaire (CAIQ), built into it.
The programme has two published levels. At Level 1 a provider completes the CAIQ itself and publishes the answers; CSA describes it as suited to lower-risk services and to providers that want transparency at low cost, and the self-assessment is updated annually. At Level 2 an independent party does the assessing: STAR Certification is an ISO/IEC 27001 certification audit extended with the CCM, carried out by a certification body on CSA's list of Certified STAR Auditors; STAR Attestation is a SOC 2 examination extended with the CCM, carried out by a CPA firm on the same list. This page is mainly about Level 2 STAR Certification, the route for providers that hold or are building an ISO/IEC 27001 system; it explains where Level 1 and STAR Attestation differ, because the choice between them is usually the first decision.
Current versions. CSA released version 4.1 of the Cloud Controls Matrix in January 2026: 207 controls in 17 domains, with eleven new control specifications, replacing v4.0 and its 197 control objectives. Since March 2026 STAR has accepted Level 1 and Level 2 submissions on either version; from December 2027 only submissions based on v4.1 are accepted, and CCM v4.0.x and CAIQ v4.0.x are withdrawn in January 2028. STAR Certification rests on ISO/IEC 27001:2022, with Amendment 1:2024, the only edition an accredited certificate may reference since the 2013 edition's certificates lapsed on 31 October 2025. First-time implementers build to CCM v4.1 from day one. What changes in CCM v4.1 and how to plan the update
Who it is for
Who needs CSA STAR certification?
STAR is written for organisations that provide cloud services: the SaaS company whose enterprise deals stall in security review, the hosting or managed-service provider answering the same two hundred questions for every prospect, the platform team inside a larger group whose customers' procurement departments now ask for a registry entry by name. Four situations bring providers to Sterling:
- A customer's procurement or vendor-risk team asks whether you are on the STAR Registry. Increasingly the question is a checkbox in a vendor assessment, and the answer decides whether the deal moves to contract. A Level 2 entry answers it once, for every customer, on a page they can check themselves.
- You hold ISO/IEC 27001 and clients keep asking what it says about the cloud. A certificate scoped to the management system does not tell a buyer how tenants are separated, how keys are managed or what happens to their data at exit. The CCM asks exactly those questions, and STAR Certification records the answers against your existing certificate.
- You have a SOC 2 report and your European, Middle Eastern or Asian prospects want an ISO-based credential. STAR Attestation adds the CCM to the SOC 2 examination; STAR Certification adds it to ISO/IEC 27001. Providers selling in both worlds often need both, and one control set can serve them.
- Your Level 1 self-assessment is out of date, or was written to look good rather than to be true. A CAIQ that has not been updated in a year, or that answers yes to controls nobody operates, is a liability the first time a customer tests it. Moving to Level 2 puts an independent assessor behind every answer.
Business benefits
How CSA STAR turns cloud security into something buyers can verify
A STAR entry is only worth having if it shortens sales cycles and survives scrutiny. We start with the questions your prospects actually ask, in their questionnaires and their contracts, and build the control set and the evidence around them.
- Security review answered onceA public Level 2 entry, backed by an independent assessment, replaces the bespoke questionnaire for many enterprise buyers and gives your sales team something to send on day one.
- Cloud-specific proof on top of ISO/IEC 27001The CCM covers tenant separation, key management, virtualisation, portability and exit, the topics an ISMS certificate alone does not answer for a cloud customer.
- Responsibilities written downThe CCM defines the security roles between the provider and its customers, so your shared-responsibility model is a documented control, not a support-desk argument.
- One control set for ISO, SOC 2 and STARCCM mappings let the same risk register, policies and evidence serve the ISMS audit, the SOC 2 examination and the STAR listing, instead of three parallel programmes.
- A maturity view management can useThe STAR Certification auditor scores the management capability of each CCM domain; the scores tell leadership where the cloud security programme is thin, before a customer finds out.
- A credential that renews on a known calendarCertification entries follow the three-year ISO/IEC 27001 cycle, attestation listings renew yearly and self-assessments annually, so the registry entry is planned, not rediscovered when it expires.
Requirements
What are the main CSA STAR requirements?
STAR does not add a management system of its own. For STAR Certification the system is ISO/IEC 27001: scope, risk assessment and treatment, the SoA, internal audit and management review are what the certification body certifies, and the CCM is the cloud control catalogue assessed alongside Annex A. For STAR Attestation the base is SOC 2: the AICPA Trust Services Criteria, with the CCM examined as additional criteria. For Level 1 there is no base at all beyond your own honesty in the questionnaire. The first table sets out the three routes; the second maps the 17 domains of the Cloud Controls Matrix that all three share.
| Level and route | What is assessed, and by whom | What is published, and for how long |
|---|---|---|
| Level 1 Self-Assessment | You complete the CAIQ against the CCM yourself; an optional AI review, Valid-AI-ted, can be added to a CAIQ v4 submission | Your questionnaire on the STAR Registry, published by CSA; self-assessments are updated annually |
| Level 2 STAR Certification | An ISO/IEC 27001 certification audit extended with the CCM and a management capability score per domain, by a certification body on CSA's Certified STAR Auditors list | A STAR certificate issued by the certification body and listed on the registry; it follows the ISO/IEC 27001 protocol and expires after three years unless updated |
| Level 2 STAR Attestation | A SOC 2 examination using the AICPA criteria together with the CCM, by a CPA firm on CSA's Certified STAR Auditors list | The attestation listed on the registry, with the SOC 2 report available to your customers under your terms; listings expire after one year unless updated |
The Cloud Controls Matrix v4.1: 17 domains, 207 controls
Whichever route you take, the questions come from the same matrix. The domain names below are CSA's own; the second and third columns are our plain-language reading of what each domain asks of a provider and what the assessor expects to see.
| CCM domain | What it requires of you | What it looks like in practice |
|---|---|---|
| A&A Audit & Assurance | Plan and run independent and internal audits, and act on what they find | An audit programme, remediation tracked to closure, and the evidence the STAR auditor asks for first |
| AIS Application & Interface Security | Build, test and change applications and APIs securely | Secure development standards, code review and testing records, API authentication and version control |
| BCR Business Continuity Management & Operational Resilience | Keep the service running and recoverable | Impact analysis, continuity and recovery plans, backup and restore tests, and the results shared with customers |
| CCC Change Control & Configuration Management | Control changes to the platform and the baselines it runs on | Change records with approval and testing, configuration baselines, and detection of unauthorised change |
| CEK Cryptography, Encryption & Key Management | Protect data with cryptography and manage the keys through their whole life | An encryption policy, key custody and rotation records, and a clear statement of which keys the customer holds |
| DCS Datacenter Security | Secure the physical facilities the service depends on, your own or a provider's | Site controls where you operate them; colocation and hyperscaler attestations filed where you do not |
| DSP Data Security & Privacy Lifecycle Management | Classify, protect, retain and dispose of customer data lawfully | Data inventory and classification, retention and deletion procedures, privacy obligations mapped to the service |
| GRC Governance, Risk & Compliance | Govern the programme: policies, risk management, compliance obligations, review | The ISMS itself: policies approved by management, a risk register with owners, and a management review that decides |
| HRS Human Resources | Screen, train and offboard the people who touch the platform | Background checks where lawful, awareness and role training records, and leaver checklists that close every account |
| IAM Identity & Access Management | Control who and what can access the platform, and with which privileges | Role-based access, multi-factor authentication, privileged-access reviews and a joiner-mover-leaver process that works |
| IPY Interoperability & Portability | Let customers move data and workloads in, out and between services | Documented export formats and APIs, and a tested data-return procedure customers can rely on at exit |
| IVS Infrastructure & Virtualization Security | Secure the shared infrastructure and separate tenants | Hardened images, network segmentation, tenant isolation evidence and capacity planning for the platform |
| LOG Logging & Monitoring | Record what happens on the platform and watch it | Log sources defined, protected and retained, alerts reviewed, and customers given visibility of their own tenancy |
| SEF Security Incident Management, E-Discovery & Cloud Forensics | Detect, respond to and learn from incidents, and preserve evidence | An incident procedure with customer notification, incident records and post-incident reviews, forensic readiness |
| STA Supply Chain Management, Transparency & Accountability | Govern your own suppliers and be transparent with your customers about who does what | The shared-responsibility model, supplier assessments, contract clauses and a published account of sub-processors |
| TVM Threat & Vulnerability Management | Find and fix weaknesses before an attacker does | Vulnerability scanning and penetration testing, patching to agreed timescales, and malware protection with evidence |
| UEM Universal Endpoint Management | Control the laptops, phones and devices that administer or access the service | A device inventory, endpoint hardening and encryption, and remote wipe for anything that reaches customer data |
What does useful CSA STAR evidence look like?
A CCM-to-SoA mapping that shows, for each of the 207 controls, whether it is implemented, by whom and where the proof sits; a shared-responsibility model published to customers; privileged-access reviews, change records and vulnerability scans with dates; tested restore and data-return procedures; incident records and customer notifications; supplier assessments; and the internal audit and management review that examined all of it. In a Sterling engagement these records live in Effivity from the first workshop, so the STAR auditor reads controls that operate and the CAIQ is generated from evidence rather than typed from memory.
The Cloud Controls Matrix explained, domain by domainCertification process
How do you get CSA STAR certified?
For STAR Certification the route runs through ISO/IEC 27001. If you already hold the certificate, the CCM is added to your ISMS and assessed by a Certified STAR Auditor, either at your next surveillance or recertification visit or at a dedicated audit; if you do not, the ISMS and the CCM are built together and assessed in one two-stage initial audit. For STAR Attestation the same control set goes into your SOC 2 examination. In every case Sterling consults, designs and prepares; the certification body or the CPA firm assesses, decides and issues, and you submit the result to the registry.
- 01Choose the level and the route, and define the service in scope.Which cloud services, regions and teams the entry must cover, whether the customer asking needs a certificate, a SOC 2 report or a self-assessment, and how the entry must read on the registry.
- 02Gap analysis: measure the ISMS and the platform against CCM v4.1.The gap analysis maps your existing controls, SoA and evidence to the 17 domains, records what is missing or undocumented, keeps what works and sets the action plan with owners and dates.
- 03Implement: the shared-responsibility model, the control set and the evidence.Responsibilities agreed and published, cloud risks added to the register, the SoA extended with the CCM, then access, logging, change, key management, continuity and exit controls put into operation, with a vulnerability assessment of the platform.
- 04Audit internally, review and complete the questionnaire.Internal audit across the ISMS and every CCM domain, management review, findings closed with evidence, and the CAIQ answered from the evidence, so a Level 1 entry can go live while Level 2 is scheduled.
- 05Pass the independent assessment.For STAR Certification, the certification body's Stage 1 readiness review and Stage 2 audit, or the extension audit it schedules, with the CCM assessed and each domain scored; for STAR Attestation, the CPA firm's examination period and fieldwork. Respond to any findings and await the decision.
- 06Submit to the registry and keep the entry alive.The certificate or attestation is submitted to CSA and published; surveillance audits continue on the ISO/IEC 27001 cycle, attestation listings renew each year, self-assessments are updated annually and the certificate is renewed before its three-year expiry.
Check the route, not only the fee. Ask which firm will assess, confirm it on CSA's Certified STAR Auditors list for the right category, certification or attestation, and check its ISO/IEC 27001 accreditation or CPA licence with the body that grants it. Treat a "STAR certificate" from a firm not on that list, or one with no ISO/IEC 27001 certification behind it, as a warning rather than a bargain. How to choose a credible CSA STAR provider · The certification buyer's checklist
Cost
How much does CSA STAR certification cost?
Adding the CCM to a working ISMS is a smaller programme than building the ISMS; building both together is an ISO/IEC 27001 programme with cloud controls from the first workshop. The number of services and regions, how much of the shared-responsibility model is already written, and whether a SOC 2 report is wanted as well set the effort. Sterling commits to a proposal with every component visible and a fee that does not move.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Whether an ISO/IEC 27001 certificate exists, the number of services, platforms and regions in scope, the state of the 17 domains today, and how much of the work your team carries (Design™ or Drive™) |
| Independent assessment | The certification body's audit days for the CCM added to the ISO/IEC 27001 audit for your scope, headcount and locations, or the CPA firm's fee for a SOC 2 examination with the CCM; quoted by the firm, identified separately in our proposal |
| Registry and scheme costs | Any fees CSA charges for listing or for optional services, confirmed with CSA at the time of submission and never included in Sterling's fee |
| Internal resources and remediation | Time from platform engineering, security, product, legal and customer teams, and any tooling for logging, key management, endpoint control or scanning the gap analysis calls for, identified there and never assumed |
| Software, assessment and learning | Included in a Sterling engagement: Effivity for the ISMS and the CCM, a vulnerability assessment of the platform and Sterling Academy access, with users and courses confirmed in the proposal |
| Continued support | Surveillance readiness, annual questionnaire updates, internal audits, supplier reviews and future CCM versions under Sustain™ |
What moves the price
- STAR Certification, STAR Attestation or both, and whether a Level 1 entry is wanted first
- Whether an ISO/IEC 27001 certificate or a SOC 2 report exists, and how well the system behind it operates
- The number of services, hyperscaler regions and colocation sites in scope
- Multi-tenant architecture, customer-managed keys and regulated or public-sector customers
- The deadline set by the prospect, and the capacity your engineers can give
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body or CPA-firm fees identified separately, so the full programme cost is comparable
- Effivity, the vulnerability assessment, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does CSA STAR certification take?
On an operating ISO/IEC 27001 ISMS, STAR Certification realistically takes three to five months from kick-off to the audit: nearer three when the platform already runs on documented baselines and the shared-responsibility model exists; nearer five when key management, logging or exit procedures have to be built and then operate long enough to leave evidence. Built together with ISO/IEC 27001, the programme takes six to ten months, because the ISMS must produce risk assessments, access reviews, an internal audit and a management review before Stage 2. A Level 1 entry can usually be published along the way, once the CAIQ is answered from evidence.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to engineers, architecture and consoles; how quickly the level, route and services in scope are decided |
| Control build and shared responsibilities | The number of domains with real gaps, engineering capacity for changes to access, logging and configuration, and the time to agree what customers must do for themselves |
| Operation and evidence | Controls running long enough to produce reviews, scans, change records and restore tests, then internal audit, management review and the questionnaire |
| Independent assessment and listing | The certification body's or CPA firm's calendar, the Stage 1 and Stage 2 or extension audit, time to close findings, and CSA's publication of the entry |
Bring the prospect's deadline to the first call. We will say what is achievable, which decisions must be taken in the first fortnight and where the risk to the date sits. A registry date promised before anyone has looked at your platform is a sales technique, not a plan.
Challenges
Common CSA STAR implementation challenges
STAR programmes stall for predictable reasons; each has a working answer.
The CAIQ was answered by sales, and nobody is sure the answers are true.
We rebuild the questionnaire from the evidence, control by control, and record the source of every answer in Effivity. A truthful "no, planned for" with a date is worth more than a "yes" that a customer's auditor disproves.
Our ISO/IEC 27001 certificate never mentioned the cloud platform.
Scope follows the services your customers use. We rewrite the scope statement around them, extend the risk assessment and the SoA with the CCM, and agree the wording with the certification body before the audit is booked.
Two hundred controls look like two hundred new documents.
They are not. Most CCM controls map to Annex A controls you already operate; the gap analysis shows which of the 17 domains genuinely need new controls, usually a handful, and the rest is mapping and evidence.
Customers want SOC 2 and STAR, and our engineers have time for one programme.
One control set, one evidence calendar. The CCM's mappings let the SOC 2 examination and the STAR Certification audit draw on the same records, and we align the examination period with the certification calendar so nobody is audited twice for the same thing.
We run on a hyperscaler; half the controls are theirs.
That half is documented, not skipped. The shared-responsibility model records what the hyperscaler attests to, what you operate and what your customers must do, and the provider's own STAR entry and certificates are filed as evidence for the domains you inherit.
Your engagement
What your CSA STAR engagement includes
Your agreed scope covers everything an operating CCM control set, a defensible registry entry and a prepared team need. Many providers deliver a completed questionnaire and a mapping spreadsheet and leave the audit to you; a Sterling engagement carries the whole programme, one team, one all-inclusive proposal.
Scope, gap analysis and implementation plan
Level, route and services decided, the gap against CCM v4.1 and ISO/IEC 27001 measured, and a plan with owners, dates and decision points.
Shared-responsibility model, risk assessment and documentation
Responsibilities between you, your providers and your customers written down, cloud risks in the register, the SoA extended with the CCM, and policies and procedures on Sterling's ISMS and cloud template sets, adapted to how your platform runs.
Effivity ISO & GRC software
Your ISMS, the CCM mapping and the questionnaire run in Effivity from day one, included with the engagement at no additional cost.
Vulnerability assessment
A vulnerability assessment of the platform and the environments you control, with findings fed into the treatment plan and tracked to closure, as the TVM domain expects.
Learning for the whole workforce
Internal auditor training for your audit team, as applicable to your standard, plus preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit, management review, CAIQ and assessment support
Conducted or facilitated as agreed, findings closed with evidence, the questionnaire completed from that evidence, then support through the certification audit or the SOC 2 examination and the registry submission until the entry is published.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your CSA STAR implementation
Every CSA STAR engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. You choose how much of the work your team carries; the method, the software and the accountability stay the same.
- 01Design™Guided implementation: your security, platform and product teams implement with Sterling's structure, CCM templates, responsibility workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed work, from the domain-by-domain mapping and the shared-responsibility model to the SoA, the questionnaire and audit preparation, with your control owners.
- 03Sustain™After the listing: annual questionnaire updates, surveillance readiness, supplier and privileged-access reviews, internal audits and new-hire awareness, year after year.
- 04Automate™The ISMS and the CCM running in Effivity: services, responsibilities, risks, the SoA, the 17 domains, evidence, audits, actions and management review in one workspace.
- 05Revise™Moves and extensions: Level 1 to Level 2, STAR Attestation beside STAR Certification, CCM v4.0 to v4.1, new services or regions, and STAR for AI when your customers ask about it.
Often combined with
Standards organisations pair with CSA STAR
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
- DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.
Effivity · CSA STAR and ISO/IEC 27001 software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of CSA STAR and the Cloud Controls Matrix v4.1.
Every Sterling CSA STAR engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the ISMS workspace within the agreed scope, so the 17 CCM domains, the shared-responsibility model, risks, the SoA, control evidence, supplier assessments, access reviews, audits and management review sit in one place, the questionnaire is answered from records that exist, and the STAR auditor reviews live controls rather than a spreadsheet of assertions. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Policies, risks and the CCM mapping
Policies with approvals and review dates, a cloud risk register with owners, and every CCM control mapped to the Annex A control, the policy and the evidence that satisfy it, with its status visible to management.
Internal audit and the questionnaire
Audit programmes across the ISMS and the 17 domains, findings and follow-up, and the CAIQ answers drawn from the same records, so Level 1 and Level 2 tell one story.
Providers, sub-processors and shared responsibilities
Supplier assessments, contract clauses and the shared-responsibility model per service, with the hyperscaler attestations you inherit filed against the domains they cover.
Access, privileges and reviews
Roles and entitlements recorded, privileged-access reviews scheduled and evidenced, and joiners, movers and leavers tracked across every tenant and console.
Log sources, alerts and customer visibility
Log sources and retention defined, monitoring reviews recorded, and the evidence a customer or auditor asks for exported from the platform rather than described.
Scans, tests and patching
Vulnerability assessment and penetration test findings tracked to closure against agreed timescales, with the patching evidence the TVM domain expects.
Plans, tests and restores
Impact analyses, continuity plans, backup and restore tests and exercise records, with the results customers are entitled to see ready to share.
Data lifecycle, keys and exit
Data classification and retention, key-management decisions and custody, and the data-return and deletion procedures that answer the exit questions in the CCM.
What this means at the audit
The STAR auditor asks for the scope, the SoA with the CCM mapping, the shared-responsibility model, the supplier assessments, the last privileged-access review, the vulnerability scans, the restore tests, the incident records, the internal audit report and the management review minutes, and then scores each domain. In Effivity each of those is a screen with dates, owners and evidence attached, not an export compiled the week before. After the listing, Sustain™ runs in the same workspace, so the annual update and the surveillance auditor find controls that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your SoA, questionnaire, supplier assessments and policies migrated, not retyped
- Admin and user training for your team
- Modules for PIMS, BCMS, QMS, PCI DSS and more when you integrate standards
CSA STAR client experience
Client letters on file, available on request.
Signed client letters for CSA STAR are available on request. The client feedback wall lists every letter by standard.
Where CSA STAR usually sits
How a cloud provider's assurance programme is run.
- 01How integrated programmes run
Cloud provider: ISO/IEC 27001, the CCM, SOC 2 and the STAR Registry as one programme
A SaaS or hosting provider commonly certifies its ISMS to ISO/IEC 27001 with the ISO/IEC 27017 and 27018 controls in scope, adds the Cloud Controls Matrix to reach STAR Certification, and produces a SOC 2 report, with the CCM examined for STAR Attestation, for the customers that ask. In such a programme one shared-responsibility model, one risk register, one SoA and one evidence base serve every assessment; the certification audit and the SOC 2 examination share one calendar, and the registry entry is renewed from records that already exist.
Sterling Academy · CSA STAR e-learning
Train the people who build, run and sell the platform, not only the security team.
Most CCM findings trace back to a person: an engineer with standing admin rights, a support agent who exported customer data to a laptop, a salesperson who answered the questionnaire from hope. Sterling Academy delivers e-learning for the whole workforce and for the people who operate the controls: video lessons with checkpoints, a final exam and a numbered Certificate of Completion. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their consultant, including complimentary awareness training for their people as part of the engagement.
- CSA STAR awareness for every employee, the awareness evidence the HRS domain and the ISMS ask for
- Practitioner courses for the ISMS lead, platform engineers, product owners and the people who answer customer questionnaires
- Internal auditor training for the people who will audit the 17 domains, as applicable to your standard, as part of the engagement
- Learner progress by team and a training status report for the STAR auditor
- New hires, contractors and administrators trained as they arrive, so evidence is current at every surveillance visit and annual update
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about CSA STAR
Watch a video on how to implement CSA STAR here.
Watch a video on CSA STAR requirements here.
Why Sterling
Want successful CSA STAR certification? Come to Sterling.
Whether you are a start-up adding the CCM to a first ISO/IEC 27001 certificate or a provider with regions on three continents and customers who ask for a registry entry, a SOC 2 report and an ISO certificate in the same tender, Sterling builds one control set with clear ownership and takes it through every assessment on one calendar.
Information security in 60+ countries since 2003
ISMS implementations for SaaS and hosting providers, BPOs, fintechs and public-sector suppliers, extended to the Cloud Controls Matrix and the STAR Registry, with one engagement team accountable in every country you operate in.
All-inclusive proposal
Consulting, Effivity, the vulnerability assessment, training and Academy access in one proposal, with certification-body, CPA-firm and CSA fees identified separately. No surprises, ever.
A questionnaire your engineers will stand behind
Every CAIQ answer traced to a control, a record and an owner in Effivity, so the entry your sales team sends is one your platform team recognises and a customer's auditor cannot pull apart.
Expert and experienced consultants
Consultants who have advised on information security management systems across sectors and countries since 2003 and know how certification bodies, CPA firms and enterprise buyers read the Cloud Controls Matrix.
The Sterling Promise
What our CSA STAR certification success guarantee means
We stay with you until the agreed CSA STAR outcome is achieved: through the mapping, the shared-responsibility model, the control build, the internal audit, the assessment and the resolution of any findings the certification body or CPA firm raises, until the entry is published. Plain explanations, practical delivery, included software and workforce learning turn the investment into a capability.
The engagement defines the level, route, scope, outcome and responsibilities. Your organisation provides accurate information, gives access to the platform, contracts and consoles in scope and puts the agreed controls into operation; commitments that depend on a hyperscaler or another provider are pursued with that provider and recorded as risks where they cannot be obtained. The certification body or the CPA firm assesses conformity, and its decision and its scoring remain its own; CSA publishes the registry entry under its own rules. Our commitment covers the agreed assessment support; it is not a warranty that no incident will ever occur.
After certification
What happens after CSA STAR certification?
A STAR Certification entry follows the ISO/IEC 27001 cycle: the certification body returns for surveillance audits, at least once a calendar year, and the certificate expires after three years unless it is renewed and the entry updated. A STAR Attestation listing expires after one year unless it is updated with a new report, and a Level 1 self-assessment is updated annually. Between those dates the controls have to keep producing evidence: access reviews, scans, change records, restore tests, supplier reviews, internal audits and management reviews.
Cloud platforms change faster than any audit cycle: a new region, a new sub-processor, a re-architected service, a customer with new contractual demands. Under Sterling OS™ Sustain™ we run the annual questionnaire update, the internal audits and the surveillance preparation with you, keep the shared-responsibility model and the CCM mapping current, and manage the move to each new version of the matrix.
FAQs
Frequently asked questions about CSA STAR
What is the difference between STAR Level 1 and Level 2?
At Level 1 you assess yourself: you complete the CAIQ against the Cloud Controls Matrix and CSA publishes your answers, which you update annually. At Level 2 an independent party assesses you: a certification body audits your ISO/IEC 27001 system with the CCM and issues a STAR Certification, or a CPA firm examines your controls against the SOC 2 criteria and the CCM and issues a STAR Attestation. Buyers in regulated or higher-risk settings usually ask for Level 2.
Do we need ISO/IEC 27001 before STAR Certification?
STAR Certification is an ISO/IEC 27001 certification extended with the CCM, so the ISMS is the foundation. You do not have to be certified first: a provider building its first ISMS can have the CCM assessed in the same initial audit, and a provider that already holds the certificate has the CCM added at a surveillance, recertification or dedicated audit. Either way the result follows the ISO/IEC 27001 protocol and expires after three years unless updated.
STAR Certification or STAR Attestation: which one do we need?
It depends on who is asking. Customers in Europe, the Middle East and Asia, and public-sector buyers generally, tend to recognise an ISO-based certificate; US enterprise customers tend to ask for a SOC 2 report. STAR Attestation adds the CCM to the SOC 2 examination and the listing expires after one year; STAR Certification adds it to ISO/IEC 27001 and lasts three years. Providers selling in both markets often hold both, on one control set.
Is there a Level 3, or a continuous option?
CSA's STAR pages and the registry currently describe two levels, and its continuous auditing metrics are published as part of the CCM toolkit rather than as a certification. You will still see a third, continuous-monitoring level referred to by providers and in older articles; plan on Level 1 and Level 2, and ask CSA directly before promising a customer anything beyond them.
Who issues the STAR certificate, and where is it published?
The certification body issues the STAR certificate, following its ISO/IEC 27001 audit, and the CPA firm issues the SOC 2 report behind a STAR Attestation; both must be on CSA's list of Certified STAR Auditors, which separates firms approved for ISO plus CSA STAR Certification from those approved for SOC 2 plus CSA STAR Attestation. You submit the result to CSA, which publishes the entry on the STAR Registry. Sterling prepares you and issues nothing.
What is the management capability score?
During a STAR Certification audit the auditor assigns a management capability score to each CCM domain, measured against a set of management principles, and reports the maturity of your processes internally, so you can see where the programme is strong and where it needs work. Ask your certification body how it reports the scores and whether any award level applies before you commit, since practice varies.
We already have ISO/IEC 27017 and 27018 on our certificate. What does STAR add?
Public visibility and a buyer-facing control catalogue. ISO/IEC 27017 and 27018 add cloud and PII-processor guidance to your ISMS; the registry entry is what procurement teams look up, and the CCM maps to the ISO/IEC 27000 family, so most of the work is already done. The gap analysis shows which of the 17 domains still need controls or evidence.
Which version of the Cloud Controls Matrix should we use, v4.0 or v4.1?
Version 4.1, released in January 2026 with 207 controls in 17 domains. CSA accepts submissions on either version until December 2027, after which only v4.1-based Level 1 and Level 2 submissions are accepted, and v4.0.x is withdrawn in January 2028. New programmes start on v4.1; existing entries are re-mapped before the next audit or annual update.
Can Sterling complete the CAIQ for us and submit it?
We complete it with you, from evidence, and you submit it: the answers are your organisation's assertions to your customers, so every one of them must be true and owned by someone in your business. A consultant who fills in a questionnaire alone, and answers yes to everything, is handing you a liability, not a listing.
What do you need to prepare a CSA STAR proposal?
The cloud services and regions in scope, whether you hold an ISO/IEC 27001 certificate or a SOC 2 report and from whom, the level and route the customer is asking for, approximate headcount and sites, and your deadline. That is enough for a scoped, all-inclusive proposal.
Before the first call
Prepare a useful CSA STAR readiness brief
You do not need a completed questionnaire before the first conversation; a short account of what you provide, who is asking and what you already hold is enough. Seven questions:
- Who is asking for a STAR Registry entry, and does their questionnaire, tender or contract name a level, a certificate or a SOC 2 report?
- Which cloud services do you provide, on which hyperscalers or facilities, in which regions, and which hold customer or personal data?
- Do you hold an ISO/IEC 27001 certificate or a SOC 2 report, from which firm, with what scope, and when is the next audit or examination period?
- Has a CAIQ ever been completed, by whom, on which CCM version, and would your engineers sign it today?
- What do your customers have to do for themselves on your platform, and where is that written down?
- How are administrator accounts, encryption keys and logs managed today, and how would a customer get their data back if they left?
- Who can take decisions on scope and route, and who from engineering, product, legal and sales can give time to implementation?
These answers let us scope the work and prepare a realistic proposal. They prepare a conversation; they are not a scored assessment and not a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not CSA STAR certification.
A STAR entry is worth something when it is on the registry, at the level the customer asked for, assessed by a firm on CSA's list and backed by controls that can be examined. The market also sells the other kind: "CSA certified" badges from providers that only filled in a questionnaire, "STAR certificates" from firms CSA has never listed, and questionnaires answered yes throughout by a consultant who never saw the platform. They are cheaper, until a customer opens the registry.
How to choose a credible CSA STAR provider
- Ask which level and route you are being sold. A Level 1 self-assessment is a legitimate, useful entry, but it is not a certification, and a provider who calls it one is describing the rest of the offer the same way.
- Ask who will assess, and find the firm on CSA's Certified STAR Auditors list in the right category, certification or attestation, then check its ISO/IEC 27001 accreditation or CPA licence with the body that grants it.
- Ask how the CCM will be assessed against your ISO/IEC 27001 system. A STAR Certification with no ISMS certification behind it does not exist; a firm that says otherwise is not offering the scheme.
- Ask who will write the answers to the questionnaire and where the evidence for each will sit. Answers without records are assertions, and your customers' auditors test assertions.
- Ask what happens in your platform. A credible programme looks at your consoles, identities, keys, logs and exit procedures; one that never does is preparing you for nothing.
- Walk away from "STAR certified in days", "no ISO 27001 needed" and one invoice for consulting and certificate. The controls have to operate, be audited internally and be reviewed by management before any firm has something to assess.
Keep exploring
More on CSA STAR and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your CSA STAR certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice