Certified CSA STAR Auditor flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

STAR Level 1

A self-assessment in which the cloud provider completes the CAIQ or CCM-based self-assessment and publishes it to the CSA STAR registry; it is free, requires no third-party auditor, and must be renewed annually.

STAR Level 2

An independent third-party assessment of a cloud provider's controls against the CCM, performed by a CSA-authorized assessor and published to the STAR registry as an assessment report or attestation.

STAR Level 3

The continuous assurance tier of the STAR program, adding ongoing monitoring and periodic reassessment on top of Level 2 requirements; it is the highest assurance level offered.

STAR registry

CSA's public repository where cloud providers publish Level 1 self-assessments, Level 2 assessment reports, and related STAR artifacts so customers can review assurance evidence.

STAR two pillars

The STAR program rests on two components: the Cloud Controls Matrix as the control framework and the CAIQ as the consensus self-assessment questionnaire derived from it.

STAR Level 1 validity

A published Level 1 self-assessment remains listed for one year from publication; the provider must resubmit an updated CAIQ annually to maintain registry presence.

CCM control ID format

Each CCM control is identified by a domain prefix plus a number, such as IVS-04; auditors cite these IDs when documenting coverage in STAR assessment reports.

CCM control ownership

CCM controls designate responsibility as CSP, cloud service customer, or shared; a CSP's assessment addresses only the portions it owns.

CCM mappings

The CCM maps controls to frameworks such as ISO/IEC 27001, NIST SP 800-53, PCI DSS, and HIPAA; these mappings are informative and do not substitute for direct control evidence.

CCM version baseline

A STAR Level 2 assessment must state which version of the CCM was used as its baseline, because the matrix is revised periodically and control numbering can change.

CCM scope property

CCM control properties indicate applicability by service model (IaaS, PaaS, SaaS), architectural relevance, and whether the control is cumulative, guiding which controls apply.

CCM v4 structure

CCM v4 organizes controls into 17 domains and adds cloud-specific concepts including shared responsibility, supply chain risk, and interoperability and portability.

CAIQ answer format

Each CAIQ question is answered Yes, No, or NA with a free-text justification; Yes answers should point to evidence the provider can produce on request.

CAIQ purpose

The Consensus Assessment Initiative Questionnaire is a standardized self-assessment derived from the CCM, used primarily for STAR Level 1 and published to the STAR registry.

CAIQ versus audit

A CAIQ is self-reported and is not an audit; it provides transparency but does not by itself constitute independent assurance of the provider's controls.

Valid-AI-ted

CSA's assessment methodology and questionnaire for AI systems, aligned with the AI Controls Matrix, providing a structured way to validate AI-specific governance and lifecycle controls.

CAIQ domain organization

CAIQ questions are grouped by CCM domain, and a complete submission should cover every applicable control for the provider's service model.

CAIQ consistency review

Auditors reviewing a CAIQ check that answers, justifications, and any published Level 2 evidence are consistent with each other and with the declared service scope.

ISO 27001 STAR route

A STAR Level 2 route in which the provider holds a valid ISO/IEC 27001 certificate and completes a CCM mapping, gap analysis, and STAR attestation with a CSA-authorized assessor.

SOC 2 STAR route

A STAR Level 2 route requiring a SOC 2 Type II report covering the relevant Trust Services Criteria, plus CCM mapping and review by a CSA-authorized assessor.

SOC 2 Type II period

A SOC 2 Type II report covers controls over an observation period, commonly six to twelve months; a Type I point-in-time report does not satisfy the STAR Level 2 SOC 2 route.

ISO 27001 certificate cycle

An ISO/IEC 27001 certificate is valid for three years with surveillance audits; the STAR Level 2 attestation must reflect the certificate's current scope and validity.

Scope alignment requirement

The underlying ISO or SOC report must cover the same services, locations, and systems as the STAR registration; mismatched scope invalidates the route.

Gap analysis obligation

Under either Level 2 route, the assessor must document gaps between the ISO or SOC report and CCM controls and note any compensating controls.

C-STAR

A CSA assessment designation in the STAR family that combines STAR Level 2 with additional criteria, providing a higher-assurance designation for cloud service providers.

STAR for AI

CSA's application of the STAR assurance model to AI systems: Level 1 self-assessment via AI-CAIQ and Level 2 third-party assessment against the AI Controls Matrix.

AI Controls Matrix

CSA's control framework for AI systems, covering AI governance, data management, model lifecycle, and responsible AI controls, mapped to CCM and external AI frameworks.

AI-CAIQ

The consensus questionnaire derived from the AI Controls Matrix, used for STAR for AI Level 1 self-assessment and answered Yes, No, or NA with justification.

AICM external mappings

AICM controls are mapped to the CCM and to AI frameworks such as the NIST AI Risk Management Framework and ISO/IEC 42001 to support combined assessments.

AI assessor authorization

C-STAR and STAR for AI assessments require CSA-authorized assessors whose authorization scope covers cloud, AI, or both, as applicable to the engagement.

AI-specific Level 2 evidence

STAR for AI Level 2 evidence must address AI risks such as training data provenance, model bias testing, and output monitoring, not only generic cloud controls.

AI-CAIQ format

AI-CAIQ answers follow the same Yes, No, or NA plus justification format as the CAIQ, with each question mapped to a specific AICM control identifier.