Certified CSA STAR Auditor common mistakes
Certified CSA STAR Auditor · Understand the traps and how to avoid them.
Treating STAR Level 1 as an independent verification of a cloud provider's controls, and describing the self-assessment as if a third party validated it.
Candidates conflate the two assurance levels because both are published on the STAR registry; the Level 1 CAIQ submission is provider-completed and self-attested, so the natural but wrong inference is that registry presence implies audit assurance.
What to do instead
Memorise the split: Level 1 is a self-assessment (provider completes CAIQ and submits to the registry, no auditor opinion); Level 2 is an independent third-party audit or certification against CCM plus a recognised framework. When a question asks what Level 1 proves, the answer is transparency/disclosure, not verified control effectiveness.
Assuming a STAR Level 2 audit can be performed against the CCM alone, without mapping to one of the recognised underlying frameworks.
The CCM is the shared control vocabulary across all routes, so candidates treat it as a standalone certification scheme rather than the overlay that must be assessed alongside ISO/IEC 27001, SOC 2, or C-STAR.
What to do instead
Learn the three Level 2 routes as CCM-plus-framework: ISO/IEC 27001 certification plus CCM, SOC 2 attestation plus CCM, and the C-STAR assessment (which uses CCM directly). If an answer option says 'CCM-only audit', it is a distractor.
Confusing the CCM's control domains with CAIQ question structure, for example claiming each CAIQ question maps one-to-one to a single CCM control.
Both artefacts share domain names and vocabulary, and the CAIQ was historically derived from the CCM, so candidates assume a clean one-to-one mapping when the CAIQ is a questionnaire instrument with its own grouping and wording.
What to do instead
Study the artefacts by purpose: CCM is a control framework with control IDs, domain structure, and mapping to standards; CAIQ is a set of yes/no questions with elaboration fields used for disclosure. Practise mapping sample CAIQ questions to CCM control IDs and note where one question touches multiple controls.
Answering CCM governance questions by describing generic security programme management rather than the CCM's specific control objectives, such as the requirement for a documented, reviewed cloud security policy owned at an appropriate level.
The CCM's governance domain overlaps heavily with ISO/IEC 27001 clauses, so candidates default to ISO language and miss the CCM-specific emphasis on cloud service provider governance, supply chain, and portability/interoperability.
What to do instead
Build a domain-by-domain summary of the CCM, noting where it goes beyond ISO/IEC 27001 (for example supply chain management, portability and interoperability, and the shared-responsibility framing). Answer with CCM terminology and control intent, not generic ISO clause numbers.
Treating the CAIQ as an evidence-submission exercise and stating that a provider must attach policies or audit artefacts to each answer.
Candidates import habits from other assurance questionnaires where evidence packs are mandatory, and the CAIQ's simple yes/no plus free-text format looks incomplete without attachments.
What to do instead
Describe the CAIQ as a disclosure instrument: yes/no answers with a written explanation of how the control is implemented, published to the registry. Evidence packs belong to the audit route (Level 2), not to the CAIQ submission itself. Keep the two artefacts separate in every answer.
Mis-describing Valid-AI-ted as an audit certification or as a replacement for the CAIQ, rather than as the AI-focused questionnaire extension aligned with the AI Controls Matrix.
The name suggests a validation or certification mark, and candidates who have not studied the AI artefacts guess from the name rather than from the structure of the STAR for AI offering.
What to do instead
Frame Valid-AI-ted as the AI questionnaire instrument used alongside the AICM for AI-related disclosure, analogous in role to the CAIQ for cloud controls. Be precise about which artefact is a matrix (AICM), which is a questionnaire (Valid-AI-ted / AI-CAIQ), and which is an assurance route (STAR for AI).
Claiming a SOC 2 report alone satisfies STAR Level 2 without the CCM mapping and STAR-specific requirements.
SOC 2 is a widely recognised attestation and candidates assume any recognised report qualifies; the STAR route requires the CCM to be assessed in addition to the underlying framework.
What to do instead
State the route explicitly: SOC 2 attestation plus assessment against the CCM, with the results published to the STAR registry. Remember that the auditor must be a recognised, qualified assessor and that the CCM coverage is what makes the report STAR-eligible, not the SOC 2 opinion by itself.
Assuming an ISO/IEC 27001 certificate automatically confers STAR Level 2 status without a CCM-scoped assessment and registry publication.
ISO/IEC 27001 is the most familiar certification and candidates equate certification with STAR recognition, overlooking the additional CCM scope and the STAR publication step.
What to do instead
Describe the ISO route as ISO/IEC 27001 certification plus a CCM assessment performed within the certification scope, followed by submission of the assessment to the STAR registry. Note that the certification body/assessor must meet STAR requirements and that the CCM results are published alongside the certificate.
Treating C-STAR as a separate framework unrelated to the CCM, or as a lower assurance tier than the ISO and SOC 2 routes.
C-STAR has its own name and is less commonly encountered, so candidates either invent a distinct control set for it or assume 'C-' signals something lesser, when it is a Level 2 route built directly on the CCM.
What to do instead
Learn C-STAR as the STAR Level 2 assessment route in which the CCM itself is the primary control framework, producing a published assessment report. Place it alongside ISO and SOC 2 as an equal Level 2 route, distinguished by framework rather than by assurance strength.
Mixing up the AI Controls Matrix and the AI-CAIQ, for example saying the AICM is a questionnaire completed by the provider and the AI-CAIQ is the control framework.
The two AI artefacts were introduced together and share naming conventions with the cloud CCM/CAIQ pair; under time pressure candidates swap the matrix and questionnaire roles.
What to do instead
Anchor the pattern: matrix = structured control framework (AICM, CCM); questionnaire = disclosure instrument (AI-CAIQ / Valid-AI-ted, CAIQ). Apply the same distinction consistently to AI questions, and link STAR for AI to the AI artefacts the way STAR Level 2 links to the CCM.