Certified CSA STAR Auditor study guide
Certified CSA STAR Auditor · Work through your exam, one topic at a time.
The Certified CSA STAR Auditor credential is aimed at professionals who assess cloud and AI services against the Cloud Security Alliance (CSA) Security, Trust, Assurance & Risk (STAR) program. The CSA STAR program is described as the industry-leading assurance program for cloud and AI, bringing together frameworks, assessments, and published assurance listings into one trusted ecosystem. STAR Level 1 is a self-assessment submitted via the Consensus Assessments Initiative Questionnaire (CAIQ), which captures how a cloud service implements each Cloud Controls Matrix (CCM) control. STAR Level 2 is a third-party audit delivered through Certification (ISO/IEC 27001), Attestation (SOC 2), or C-STAR for the Greater China market, each combined with a CAIQ submission. The Certified CSA STAR Auditor study guide has 5 sections and about 2,587 words.
01STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)
The CSA STAR (Security, Trust, Assurance and Risk) program is a public registry and assurance framework for cloud service providers. The exam tests your ability to distinguish the assurance levels, the evidence each requires, and the roles of provider, auditor, and CSA.
387 words, about 2 min02Cloud Controls Matrix (CCM) framework
The CCM is CSA's cloud-specific control framework. The exam tests its structure, control specifications, domain organization, versioning, and how it is used as audit criteria in STAR Level 2.
366 words, about 2 min03Consensus Assessment Initiative Questionnaire (CAIQ) and Valid-AI-ted
The CAIQ is the Consensus Assessment Initiative Questionnaire, the questionnaire counterpart to the CCM. Valid-AI-ted is CSA's AI validation framework.
361 words, about 2 min04STAR Level 2 audit routes: ISO/IEC 27001 certification and SOC 2 attestation
STAR Level 2 can be reached through three routes. This section covers ISO/IEC 27001 certification and SOC 2 attestation; C-STAR is covered separately.
400 words, about 2 min05C-STAR
C-STAR (Cloud Security STAR) is CSA's direct STAR Level 2 audit route. The exam tests how C-STAR differs from ISO and SOC 2 routes, the audit process, and certificate validity.
1,073 words, about 5 min