197 Yes answers and two deals on the line
Corvus Analytics publishes a STAR Level 1 self-assessment for its analytics platform. The submitted CAIQ records 'Yes' against all 197 CCM v4 controls, with zero 'No' and zero 'Not Applicable'. In reality: the platform runs on GCP; Corvus owns no datacenters; endpoint management is partly BYOD across 120 laptops, of which roughly 40% are unmanaged; logging is outsourced to a subprocessor that retains logs for 14 days; and there is no formal vulnerability remediation SLA, although authenticated scans run monthly. The compliance manager argues that customers only count the 'Yes' answers, that Level 1 is self-assessed anyway, and that correcting the file will lose two deals currently in procurement. Corvus also wants to start describing itself as 'STAR Level 2 ready' in marketing.
1. Evaluate the CAIQ as submitted. Which entries are wrong, and what is the actual harm?
Read the worked answer
The file is not a self-assessment; it is a sales artifact with a CSA logo on it.
- UEM (Universal Endpoint Management): answering 'Yes' while 40% of laptops are unmanaged is false on its face. The control expects endpoint inventory, configuration standards, encryption and malware protection enforced across endpoints that can reach the platform. Unmanaged BYOD reaching production data is a 'No' with a stated gap.
- LOG (Logging and Monitoring): 14-day retention with an outsourced subprocessor may be a 'Yes' only if the control's retention and protection requirements are met and the subprocessor is disclosed. If the retention period or the customer's access to logs falls short, it is 'No'.
- TVM (Threat and Vulnerability Management): monthly scanning without a remediation SLA is at best 'No' - detection without a defined timeframe for fixing is not a vulnerability management control.
- DCS (Datacenter Security): these are inherited from GCP, not operated by Corvus. The correct treatment is still an answer from Corvus's perspective, with the reliance on GCP disclosed, not a blanket 'Yes' that implies Corvus runs facilities.
The harm is concrete: the registry is public and read by auditors, and a prospective Level 2 assessor will test the same controls against the same answers. Inconsistency between the published self-assessment and the audit findings is the fastest way to lose a Level 2 outcome, and CSA can challenge or remove inaccurate listings. Level 1 being self-assessed means unverified, not unaccountable.
2. Rewrite two of the answers properly, including how inheritance should be expressed.
Read the worked answer
UEM - endpoint management (illustrative rewrite):
Answer: No. 120 corporate laptops; 48 are BYOD enrolled only in MDM-lite with no configuration baseline, disk-encryption attestation or patch enforcement. Managed fleet meets the control; the BYOD population does not. Remediation: enforce MDM enrolment with encryption and screen-lock policy by Q3, or block BYOD access to production data. Compensating control: conditional access requiring device compliance for any session touching customer data.
LOG - logging and monitoring (illustrative rewrite):
Answer: Yes, with reliance on a subprocessor. Application and access logs ship to [subprocessor], retention 14 days hot plus 12 months cold archive, immutable storage, restricted to the security team. Subprocessor is named in the subprocessor list and covered by the DPA. Gap: customer-facing log export is manual and takes 5 working days, which does not meet the control's expectation of timely customer access.
How inheritance is expressed: the control is still answered as it applies to Corvus's service. Where GCP operates the control, the answer says so, names the underlying provider, and points to the artifact relied on (GCP's own assurance reports and the shared-responsibility matrix). Where the control splits - GCP secures the hypervisor, Corvus secures the guest OS and IAM - the answer states which half Corvus does. 'Inherited' is never used to mean 'not our problem'.
3. Can Corvus describe itself as 'STAR Level 2 ready'? What can marketing say?
Read the worked answer
No. 'Level 2 ready' is not a program status. STAR defines Level 1 (self-assessment published to the registry) and Level 2 (independent third-party assessment). There is no readiness tier, no badge, and no registry entry for it, so the phrase borrows the credibility of a level Corvus has not reached while being unfalsifiable - which is precisely why procurement teams treat it as a red flag.
What can be said, accurately:
- 'STAR Level 1 self-assessment published to the CSA STAR Registry' - with a link, once the corrected CAIQ is live.
- 'CCM v4 gap assessment completed; remediation plan targeted at STAR Level 2 by [quarter]' - a factual statement about work in progress.
- Named, dated evidence commitments in contracts, which are worth more than any badge.
Sequencing matters. Correct the CAIQ first, then talk. Publishing a downgraded assessment looks like rigour if it is accompanied by a remediation plan; publishing a perfect one and then failing an audit looks like concealment. The two at-risk deals should be told directly by the account owner, with the corrected file and the remediation dates, before a procurement analyst finds the inconsistency. Some deals will slip. That is the cost of a self-assessment that means something.