Certified CSA STAR Auditor case studies
Certified CSA STAR Auditor · Put your knowledge to work in context.
The Certified CSA STAR Auditor credential is aimed at professionals who assess cloud and AI services against the Cloud Security Alliance (CSA) Security, Trust, Assurance & Risk (STAR) program. The CSA STAR program is described as the industry-leading assurance program for cloud and AI, bringing together frameworks, assessments, and published assurance listings into one trusted ecosystem. The Certified CSA STAR Auditor case studies are 5 cases and about 4,115 words.
1The ISO 27001 certificate that names the wrong system
Meridian Cloud is a 220-person SaaS provider whose HR platform processes payroll for 1,400 enterprise customers. It holds ISO/IEC 27001:2022 certification from an accredited certification body, but the scope statement reads 'corporate information systems supporting finance, HR and software development at the Dublin and Lisbon offices'.
771 words, about 4 min2SOC 2 Type I in hand, Type II window still open
Halcyon Ledger runs a payments reconciliation API used by 300 fintechs, processing 40 million records a day. It has a SOC 2 Type I report issued four months ago covering the Security and Availability categories, produced by a CPA firm, with no exceptions noted.
850 words, about 4 min3197 Yes answers and two deals on the line
Corvus Analytics publishes a STAR Level 1 self-assessment for its analytics platform. The submitted CAIQ records 'Yes' against all 197 CCM v4 controls, with zero 'No' and zero 'Not Applicable'.
826 words, about 4 min4A hiring model built on someone else's foundation model
Aster Screening sells a candidate-ranking model to 12 enterprise employers in the EU. Its stack combines a third-party foundation-model API for embeddings and scoring, a fine-tune trained on 2.3 million historical CVs (60% supplied by customers under contract, 40% scraped from a job board in 2021), and an internal rules layer that produces the final ranking.
850 words, about 4 min5Three customers, three different assurance sentences
Bramble Health builds a patient-triage platform used by 40 clinics in the UK. It is 90 people, holds no ISO/IEC 27001 certificate, and has never had a SOC examination; its controls live in a 200-page internal wiki and a homegrown risk register.
818 words, about 4 min