Certified CSA STAR Auditor: C-STAR study guide

C-STAR

C-STAR (Cloud Security STAR) is CSA's direct STAR Level 2 audit route. The exam tests how C-STAR differs from ISO and SOC 2 routes, the audit process, and certificate validity.

Core rules

C-STAR is a third-party audit performed by a CSA-recognized auditor directly against the CCM. No underlying ISO or SOC 2 report is required.
The audit includes document review, control testing, interviews, and evidence sampling. The auditor issues a C-STAR certificate and a public STAR registry entry. The audit report includes the scope, criteria, findings, and auditor opinion.
C-STAR is cloud-specific and uses the full CCM as criteria, so no gap assessment is needed (the whole audit is CCM-based).
C-STAR certificates have a defined validity period (commonly three years) with annual surveillance audits. The auditor must be independent and CSA-approved.
C-STAR is often chosen by providers who do not hold ISO 27001 or SOC 2, or who want a cloud-native audit. C-STAR is listed as a distinct route on the STAR registry.

Worked example

A cloud provider has no ISO or SOC 2. They want STAR Level 2. They engage a CSA-approved auditor for C-STAR. The auditor scopes the cloud service, reviews policies, tests controls such as access management and encryption, and interviews control owners. The auditor issues a C-STAR certificate. The provider is listed on the STAR registry. Reasoning: C-STAR is a direct CCM audit; it replaces the need for a separate ISO/SOC 2 gap assessment. The audit evidence must cover all in-scope CCM controls.

Traps

Thinking C-STAR is a self-assessment. It is Level 2, third-party audited.
Assuming C-STAR requires an ISO 27001 prerequisite. It does not.
Confusing C-STAR with CAIQ. CAIQ is a questionnaire; C-STAR is an audit.
Forgetting surveillance audits; C-STAR is not a one-time certificate forever.

STAR for AI

STAR for AI extends the CSA STAR assurance model to AI systems. The exam tests how AI assurance levels map to the cloud STAR levels, the role of AI-CAIQ and AICM, and the scope of AI audits.

Core rules

STAR for AI has assurance levels analogous to cloud STAR: Level 1 self-assessment using the AI-CAIQ, and Level 2 third-party audit against the AI Controls Matrix (AICM). A Level 3 continuous monitoring may follow.
The AI-CAIQ is the questionnaire aligned to AICM; it covers AI governance, data quality, model training, bias, explainability, and human oversight.
AICM is the control framework for AI; it complements CCM rather than replacing it. For AI systems that also process cloud data, both CCM and AICM may apply.
STAR for AI Level 2 requires a CSA-recognized auditor with AI competency. The audit evidence includes model documentation, testing results, and risk assessments.
The STAR registry lists AI systems separately from cloud services. Level 2 attestations are listed with the audit period and auditor.

Worked example

An AI vendor offers a recommendation engine. They want STAR for AI Level 1. They complete the AI-CAIQ, answering questions about training data provenance and bias testing, and publish it on the CSA registry. A customer requires independent assurance. The vendor engages a CSA auditor for STAR for AI Level 2. The auditor audits against AICM, samples model validation records, and issues an attestation. Reasoning: the AI-CAIQ is self-declared at Level 1; Level 2 requires AICM audit. The cloud CCM audit does not cover AI-specific controls.

Traps

Treating STAR for AI as identical to cloud STAR. The controls and questionnaire differ.
Assuming AICM replaces CCM. They are complementary frameworks.
Using the cloud CAIQ for an AI system; the AI-CAIQ is the correct questionnaire.
Believing STAR for AI Level 1 is audited. It is self-assessment.

AI Controls Matrix (AICM) and AI-CAIQ

The AICM is CSA's control framework for AI systems, and the AI-CAIQ is its questionnaire. The exam tests the AICM structure, domains, mapping to CCM, and how AI-CAIQ supports STAR for AI.

Core rules

AICM v1 organizes AI controls into domains such as AI Governance, AI Risk Management, Data Management, Model Development, Model Deployment, Monitoring, and Ethics. Each control has an ID and specification.
AICM is AI-specific and maps to CCM, ISO/IEC 42001, NIST AI RMF, and other frameworks.
AI-CAIQ contains one question per AICM control, with Yes/No/NA answers and evidence fields. It is used for STAR for AI Level 1 self-assessment.
For STAR for AI Level 2, the auditor uses AICM as audit criteria and verifies evidence; AI-CAIQ can be a readiness tool.
AICM is not a replacement for CCM; it addresses AI risks that CCM does not cover (e.g., model bias, explainability, training data lineage). AICM controls are outcome-based and auditable; they are not merely guidance.

Worked example

An auditor is assessing an AI model's data governance. The AICM control 'Data Provenance' requires documented sources and consent for training data. The provider has a CCM data classification control, but that does not cover training data lineage. The auditor tests the AICM control by reviewing data dictionaries and consent records. If the provider meets the specification, the control passes; otherwise, the auditor records a gap. Reasoning: AICM fills AI-specific gaps; CCM alone is insufficient for AI assurance.

Traps

Confusing AICM with CCM. AICM is for AI; CCM is for cloud.
Thinking AI-CAIQ is the same as CAIQ. They align to different matrices.
Assuming AICM covers only generative AI. It covers all AI systems.
Believing AICM certification exists independently. It is used within STAR for AI audits.