Certified CSA STAR Auditor cheat sheet

STAR (Security, Trust, Assurance and Risk) is the CSA registry program; it has three assurance levels: Level 1 self-assessment, Level 2 third-party audit, and Level 3 continuous audit/monitoring.

STAR Level 1 is a self-assessment: the cloud provider completes the CAIQ (or CCM-based self-assessment) and publishes it to the STAR registry; it is free and open to any CSA corporate member.

STAR Level 2 requires independent, third-party assessment of the CSP's controls against the CCM; the auditor must be a CSA-authorized STAR assessor or hold an accepted certification/attestation route.

STAR Level 3 (continuous) adds continuous monitoring and periodic reassessment on top of Level 2; it is the highest assurance tier in the program.

The STAR registry publishes Level 1 self-assessments publicly and Level 2 assessment reports/attestations with restricted or public visibility depending on the CSP's choices.

STAR is built on two pillars: the Cloud Controls Matrix (CCM) as the control framework and the CAIQ as the self-assessment questionnaire.

Level 1 submissions are valid for one year from publication; providers must re-submit annually to remain listed.

STAR does not certify a CSP as 'secure'; it attests that controls were assessed against CCM and reports results transparently.

The CCM is CSA's cybersecurity control framework for cloud, organized into control domains (e.g., A&A, CCC, DSI, IPY, IVS, SEF) each containing control specifications with control IDs.

Each CCM control has a control specification, a set of control properties (e.g., scope applicability, ownership), and mappings to other standards such as ISO/IEC 27001, NIST SP 800-53, PCI DSS, and HIPAA.

CCM v4 restructured controls into 17 domains and added cloud-specific concepts like shared responsibility, supply chain, and interoperability/portability.

CCM control IDs follow a domain prefix plus number (e.g., 'IVS-04'); auditors cite these IDs in STAR Level 2 assessment reports.

The CCM defines control ownership as CSP, CSC (cloud service customer), or shared; auditors must check that the CSP addresses only the CSP-owned portions.

CCM mappings to other frameworks are informative, not equivalence claims; an auditor cannot substitute a mapping for direct evidence of the CCM control.

CCM is updated periodically; STAR Level 2 audits must state which CCM version was used as the assessment baseline.

CCM control properties include scope (IaaS/PaaS/SaaS), architectural relevance, and whether the control is cumulative or not.

The Consensus Assessment Initiative Questionnaire (CAIQ) is the standardized self-assessment questionnaire derived from the CCM; each question maps to a CCM control ID.

CAIQ answers are Yes/No/NA with a free-text justification; 'Yes' answers should reference evidence the CSP can produce on request.

The CAIQ is the primary instrument for STAR Level 1 self-assessment; completed CAIQs are published to the STAR registry.

Valid-AI-ted is CSA's assessment methodology/questionnaire for AI systems, aligned with the AI Controls Matrix (AICM); it provides a structured way to validate AI-specific controls.

CAIQ is not an audit; it is a self-reported consensus questionnaire and does not by itself constitute assurance.

CAIQ questions are organized by CCM domain; a completed CAIQ should cover every applicable CCM control for the CSP's service model.

Valid-AI-ted extends the consensus assessment approach to AI, covering governance, model lifecycle, data, and transparency controls.

Auditors reviewing a CAIQ should check consistency between answers, justifications, and any published Level 2 evidence.

STAR Level 2 can be achieved via an ISO/IEC 27001 certification route: the CSP holds a valid ISO/IEC 27001 certificate plus a completed CCM/CAIQ mapping and a STAR Level 2 attestation.

The SOC 2 route requires a SOC 2 Type II report (period of time, not point-in-time) covering the Trust Services Criteria relevant to the cloud service, plus CCM mapping.

ISO/IEC 27001 certificates are valid for three years with surveillance audits; the STAR Level 2 attestation must reflect the current certificate scope.

SOC 2 Type II reports cover a defined observation period (commonly 6-12 months); a Type I report (point-in-time) does not satisfy the STAR Level 2 SOC 2 route.

Both routes require a CSA-authorized assessor to review the underlying report, verify scope alignment with the cloud service, and complete the STAR Level 2 assessment.

Scope alignment is critical: the ISO/SOC report must cover the same services, locations, and systems as the STAR registration.

The assessor must document any gaps between the ISO/SOC report and the CCM controls and note compensating controls.

STAR Level 2 via ISO or SOC 2 does not waive CCM coverage; the mapping and gap analysis are mandatory parts of the submission.

C-STAR (Cloud Security STAR) is CSA's assessment for cloud service providers that combines STAR Level 2 with additional criteria; it is a higher-assurance designation in the STAR family.

STAR for AI applies the STAR assurance model to AI systems: Level 1 self-assessment via AI-CAIQ, Level 2 third-party assessment against the AI Controls Matrix.

The AI Controls Matrix (AICM) is CSA's control framework for AI systems, covering AI governance, data management, model lifecycle, and responsible AI controls.

AI-CAIQ is the consensus questionnaire derived from the AICM, used for STAR for AI Level 1 self-assessment.

AICM controls are mapped to CCM and to external AI frameworks (e.g., NIST AI RMF, ISO/IEC 42001) to support combined assessments.

C-STAR and STAR for AI assessments require CSA-authorized assessors with the relevant scope (cloud and/or AI) on their authorization.

The AI-CAIQ answers follow the same Yes/No/NA plus justification format as the CAIQ, mapped to AICM control IDs.

STAR for AI Level 2 evidence must address AI-specific risks such as training data provenance, model bias testing, and output monitoring, not just generic cloud controls.