Certified CSA STAR Auditor
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Certified CSA STAR Auditor credential is aimed at professionals who assess cloud and AI services against the Cloud Security Alliance (CSA) Security, Trust, Assurance & Risk (STAR) program. The CSA STAR program is described as the industry-leading assurance program for cloud and AI, bringing together frameworks, assessments, and published assurance listings into one trusted ecosystem. STAR Level 1 is a self-assessment submitted via the Consensus Assessments Initiative Questionnaire (CAIQ), which captures how a cloud service implements each Cloud Controls Matrix (CCM) control. STAR Level 2 is a third-party audit delivered through Certification (ISO/IEC 27001), Attestation (SOC 2), or C-STAR for the Greater China market, each combined with a CAIQ submission. For AI services, STAR for AI uses the AI Controls Matrix (AICM) as the basis of every assessment, with the AI-CAIQ as the submitted artifact for Level 1 and Level 2. Valid-AI-ted provides automated validation of a CAIQ or AI-CAIQ submission, returning scoring and improvement guidance and adding a badge to the Registry listing. STAR for AI Level 2 routes include ISO/IEC 27001, ISO/IEC 27001 + 42001, ISO/IEC 42001, and SOC 2, each paired with an AI-CAIQ passed through Valid-AI-ted. Candidates should study the STAR program structure, CCM and AICM frameworks, CAIQ and AI-CAIQ artifacts, audit routes, and the STAR Registry. Preparation can include CSA’s STAR Auditor Training and reviewing the CCM, AICM, CAIQ, and AI-CAIQ resources. This page is independent study material and is not affiliated with or endorsed by CSA.
What you'll study
About Certified CSA STAR Auditor preparation
What is the Certified CSA STAR Auditor exam about?
It tests knowledge of the CSA STAR program for cloud and AI assurance. Expect coverage of STAR Level 1 self-assessment and Level 2 third-party audit, the Cloud Controls Matrix (CCM), the Consensus Assessments Initiative Questionnaire (CAIQ), audit routes such as ISO/IEC 27001, SOC 2, and C-STAR, plus STAR for AI, the AI Controls Matrix (AICM), and the AI-CAIQ. The exam assesses whether you understand how these components fit together in the STAR ecosystem.
Who should take this exam?
It suits cloud security auditors, assessors, compliance professionals, and consultants who evaluate cloud or AI services against CSA frameworks. It is also relevant for providers preparing for STAR Level 1 or Level 2 submissions, and for risk and assurance teams who use the STAR Registry to compare listings. A background in security controls, audit processes, and cloud governance helps, but the exam focuses on STAR-specific knowledge.
What is the exam format and how long does it take?
The source material does not specify the exam format, number of questions, duration, or passing score. Those details are set by CSA and may change. Check the official CSA exams platform for the current structure before you schedule. This page cannot confirm timing or item counts.
How much does the exam cost and is there a retake policy?
Fees and retake rules are not stated in the available CSA source text. They are administered by CSA and can vary by region or membership status. Consult the CSA exams or training site for current pricing and retake conditions. Do not rely on third-party figures, because they may be outdated.
How long is the certification valid?
The source does not state a validity period or renewal requirement for the Certified CSA STAR Auditor credential. CSA may update continuing education or recertification policies. Verify the current terms on the official CSA certification pages before you plan recertification.
What are the main STAR assurance levels I need to know?
STAR Level 1 is a self-assessment: submit the CAIQ directly, or through Valid-AI-ted for automated scoring and a Valid-AI-ted badge. STAR Level 2 is a third-party audit: Certification (ISO/IEC 27001), Attestation (SOC 2), or C-STAR for the Greater China market, each combined with a CAIQ submission. STAR for AI mirrors this with Level 1 self-assessment and Level 2 third-party assurance using the AI-CAIQ.
What is the difference between CCM and AICM?
The Cloud Controls Matrix (CCM) is the framework behind the CAIQ and supports STAR Level 1 and Level 2 for cloud services. The AI Controls Matrix (AICM) is a vendor-neutral framework for building secure, responsible, and well-governed AI systems, and AICM controls are the basis of every STAR for AI assessment. The CAIQ captures how a cloud service implements each CCM control; the AI-CAIQ captures how an AI service implements each AICM control.
What is Valid-AI-ted and when is it used?
Valid-AI-ted performs automated validation of a CAIQ or AI-CAIQ submission, returns scoring and improvement guidance, and adds a Valid-AI-ted badge to your Registry listing. It connects to STAR Level 1, STAR for AI Level 1, and STAR for AI Level 2. For STAR for AI Level 2, each of the four routes (ISO/IEC 27001, ISO/IEC 27001 + 42001, ISO/IEC 42001, and SOC 2) is paired with an AI-CAIQ passed through Valid-AI-ted.
Which STAR for AI Level 2 routes exist?
The source lists four routes: ISO/IEC 27001, ISO/IEC 27001 + 42001, ISO/IEC 42001, and SOC 2. Each route is paired with an AI-CAIQ passed through Valid-AI-ted. Knowing these combinations is important because the exam may test how AI assurance builds on existing management system certifications and attestations.
What is a common failure mode for candidates?
A frequent mistake is confusing the cloud and AI tracks: mixing CCM with AICM, CAIQ with AI-CAIQ, or STAR Level 2 routes with STAR for AI Level 2 routes. Another is assuming Valid-AI-ted replaces a third-party audit; it does not. It validates submissions and adds a badge. Also, do not memorize fees or formats from unofficial sources, because the exam source may differ.
How should I prepare and in what order?
Start with the STAR program structure and the difference between Level 1 and Level 2. Then study the CCM and CAIQ, followed by the AICM and AI-CAIQ for STAR for AI. Review the Level 2 audit routes for both cloud and AI, and understand Valid-AI-ted’s role. CSA offers STAR Auditor Training and publishes the CCM, AICM, CAIQ, and AI-CAIQ resources. Use the STAR Registry to see real listings and badges.