STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)
STAR Program and assurance levels
The CSA STAR (Security, Trust, Assurance and Risk) program is a public registry and assurance framework for cloud service providers. The exam tests your ability to distinguish the assurance levels, the evidence each requires, and the roles of provider, auditor, and CSA.
Core rules
- STAR Level 1 is a self-assessment. The provider completes the CAIQ (or a CCM-based self-assessment), publishes it on the CSA STAR registry, and declares compliance. There is no independent verification. It is free and transparent.
- STAR Level 2 is a third-party audit. A CSA-recognized auditor assesses the provider against the CCM. The audit can follow three routes: ISO/IEC 27001 certification plus a CCM gap assessment, SOC 2 attestation plus a CCM gap assessment, or C-STAR (a direct CCM audit). The result is a STAR Level 2 certificate or attestation, listed publicly.
- STAR Level 3 is continuous monitoring, where the provider publishes security metrics and controls continuously. It is less commonly tested but completes the assurance continuum.
- Key terms: CAIQ (questionnaire), CCM (controls), STAR registry (public listing), attestation (auditor's opinion), certification (auditor's certificate).
Worked example
A SaaS provider wants a STAR listing. They complete the CAIQ, answer all questions, and publish it on the CSA STAR registry. That is Level 1. A customer asks for independent assurance. The provider engages a CSA-approved auditor. Because they already hold ISO/IEC 27001, the auditor performs a CCM gap assessment and issues a STAR Level 2 attestation. Reasoning: Level 1 is self-declared; Level 2 requires third-party verification. The ISO certificate alone is not a STAR Level 2; the auditor must map and assess CCM controls.
Traps
- Believing STAR Level 1 is audited or certified. It is self-assessment only.
- Thinking STAR Level 2 always requires C-STAR. ISO 27001 and SOC 2 are valid routes with a CCM gap assessment.
- Confusing the STAR registry entry (public) with the audit report (confidential evidence).
- Assuming any auditor can issue STAR Level 2; the auditor must be CSA-recognized.