STAR Level 2 audit routes: ISO/IEC 27001 certification and SOC 2 attestation
STAR Level 2 audit routes: ISO/IEC 27001 and SOC 2
STAR Level 2 can be reached through three routes. This section covers ISO/IEC 27001 certification and SOC 2 attestation; C-STAR is covered separately. The exam tests the conditions under which these routes qualify and the role of the CCM gap assessment.
Core rules
- ISO/IEC 27001 route: The provider holds a valid ISO/IEC 27001 certificate from an accredited certification body. A CSA-recognized auditor then performs a gap assessment against the CCM. The auditor issues a STAR Level 2 attestation/certificate covering the CCM controls not covered by ISO 27001.
- SOC 2 route: The provider has a SOC 2 attestation (typically Type II) covering the Trust Services Criteria. A CSA-recognized auditor maps the SOC 2 report to CCM and audits the gaps. The result is a STAR Level 2 attestation.
- In both routes, the existing certificate/report is not sufficient alone. The CSA auditor must verify CCM coverage and issue a STAR-specific opinion.
- The auditor must be CSA-recognized and independent. The audit scope must match the cloud service.
- The STAR Level 2 listing states the route used and the audit period.
Worked example
A provider has ISO/IEC 27001:2022 certification. They want STAR Level 2. They engage a CSA-approved auditor. The auditor reviews the ISO Statement of Applicability, maps each ISO control to CCM v4, and identifies gaps (e.g., CCM's supply chain controls not fully covered by ISO). The auditor tests the gap controls and issues a STAR Level 2 certificate. Reasoning: ISO 27001 provides a baseline, but CCM is cloud-specific; the gap assessment is mandatory.
Traps
- Assuming ISO 27001 certification automatically equals STAR Level 2. It does not; the CCM gap assessment is required.
- Using a SOC 2 Type I report as if it were a period audit. Type II is generally expected for STAR Level 2 because it covers operating effectiveness over time.
- Forgetting that the auditor must be CSA-recognized, not just any ISO or SOC 2 auditor.
- Mixing the audit periods: the STAR attestation must align with the underlying report's period or be updated.