Certified CSA STAR Auditor study plan
Certified CSA STAR Auditor · Give each week a clear focus.
8 weeks · About 7 hours per week
STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit) & Cloud Controls Matrix (CCM) framework
Map the CSA STAR program structure: distinguish STAR Level 1 self-assessment from STAR Level 2 third-party audit, and state the evidence each level requires.
Describe how the CCM is organized (control domains, control IDs, control specifications, maturity levels) and explain its relationship to STAR.
Identify the STAR Level 1 submission workflow: CAIQ completion, self-assessment attestation, and public registry listing.
Compare the roles and responsibilities of cloud provider, auditor, and CSA in each assurance level.
Your checkpoint
Produce a one-page comparison table of STAR Level 1 vs Level 2 covering evidence, assessor independence, public disclosure, and renewal cadence.
Cloud Controls Matrix (CCM) framework
Memorize the CCM control domains and their scope (e.g., governance, identity, data security, operations) without referring to notes.
Explain the CCM maturity model levels and how an auditor evaluates maturity evidence.
Practice mapping a sample cloud service control to the corresponding CCM control ID and specification.
Differentiate CCM controls from complementary controls and describe how inheritance affects audit scope.
Your checkpoint
Create a flashcard set covering all CCM domains and at least 30 control IDs with one-line scope statements, scored at 90% accuracy.
Consensus Assessment Initiative Questionnaire (CAIQ) and Valid-AI-ted
Explain the purpose and structure of the CAIQ, including how each question maps to CCM controls.
Evaluate sample CAIQ responses for completeness, consistency, and evidence traceability.
Describe the Valid-AI-ted assessment approach and how it extends consensus assessment to AI systems.
Draft audit-ready follow-up questions for ambiguous CAIQ answers.
Your checkpoint
Complete a mock CAIQ review of 20 questions with written auditor commentary and a list of evidence requests for each response.
Consensus Assessment Initiative Questionnaire (CAIQ) and Valid-AI-ted & STAR Level 2 audit routes: ISO/IEC 27001 certification, SOC 2 attestation, C-STAR
Compare STAR Level 2 audit routes: ISO/IEC 27001 certification, SOC 2 attestation, and C-STAR.
Explain how ISO/IEC 27001 certification is used as a STAR Level 2 route, including scope alignment and certificate validity.
Describe how a SOC 2 report supports STAR Level 2 and what trust services criteria must be addressed.
Identify the additional CCM-specific requirements that apply beyond the underlying ISO or SOC 2 framework.
Your checkpoint
Write a decision matrix that selects the appropriate Level 2 route for three hypothetical cloud providers with different service models and customer bases.
STAR Level 2 audit routes: ISO/IEC 27001 certification, SOC 2 attestation, C-STAR
Outline the C-STAR audit process: scoping, evidence collection, control testing, and reporting.
Explain how an auditor verifies CCM control coverage when the underlying certification or attestation does not address all CCM controls.
Describe the requirements for auditor independence, competence, and CSA recognition.
Identify common gaps between ISO/IEC 27001 or SOC 2 evidence and STAR Level 2 expectations.
Your checkpoint
Produce an audit plan template for a C-STAR engagement listing scope, control mapping, evidence sources, and sampling approach.
STAR for AI, AI Controls Matrix (AICM) and AI-CAIQ
Explain the scope and structure of STAR for AI and how it adapts the STAR assurance model to AI systems.
Describe the AI Controls Matrix (AICM): its domains, control objectives, and how it complements the CCM.
Explain the AI-CAIQ and how its questions map to AICM controls.
Identify AI-specific risks (e.g., model governance, data provenance, bias, transparency) and the corresponding AICM controls.
Your checkpoint
Build a mapping table linking five AI-CAIQ questions to AICM control IDs and the evidence an auditor would request for each.
STAR for AI, AI Controls Matrix (AICM) and AI-CAIQ & STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit)
Evaluate how STAR for AI assurance levels align with the traditional STAR Level 1 and Level 2 model.
Assess sample AI system documentation against AICM requirements and document findings.
Revisit STAR program governance, registry requirements, and recertification timelines for both traditional and AI assessments.
Practice writing audit findings that cite specific CCM, AICM, or CAIQ references.
Your checkpoint
Draft a mock audit finding report with three findings, each citing the relevant framework reference and recommended remediation.
STAR Program and assurance levels (STAR Level 1 self-assessment, STAR Level 2 third-party audit) & Cloud Controls Matrix (CCM) framework & Consensus Assessment Initiative Questionnaire (CAIQ) and Valid-AI-ted & STAR Level 2 audit routes: ISO/IEC 27001 certification, SOC 2 attestation, C-STAR & STAR for AI, AI Controls Matrix (AICM) and AI-CAIQ
Complete a full timed practice exam and review every incorrect answer by domain.
Rehearse explaining the differences between STAR Level 1, Level 2, and STAR for AI in under five minutes.
Verify recall of CCM and AICM domain structures and key control IDs without reference materials.
Finalize a personal exam-day strategy covering question triage, time allocation, and flagging uncertain items.
Your checkpoint
Score at least 85% on a full-length practice exam and submit a written remediation log for every missed question.
Milestones
Week 2: Score 90% or higher on the CCM domain and control ID flashcard assessment.
Week 4: Correctly match all three STAR Level 2 audit routes to appropriate provider scenarios in the decision matrix.
Week 6: Demonstrate accurate AICM and AI-CAIQ mapping for five AI-specific risk scenarios.
Week 8: Achieve 85% or higher on a timed full-length practice exam with a completed remediation log.