Build trust with CSA STAR in 2024

The Cloud Security Alliance (CSA) has the Security, Trust, and Risk (STAR) accreditations and register to track three levels of compliance with the cloud controls matrix (CCM). 

The CCM covers 17 domains and 197 control objectives related to best practice cloud security.

Level One accreditation is based on completing questionnaires to provide information that may or may not have been independently verified into the online CSA register for third party review. Level Two is a certification or attestation report that’s been independently audited and submitted to the CSA. Level Three is a level of continuous assurance for the higher standard of cloud security and third party assurance.

Yes, but you can do both together. Level One is a completed questionnaire that’s submitted to the CSA registry covering the same details as what’s audited for Level Two accreditation covering the cloud controls matrix. 

Yes. You either need to show how your cloud security practices meet each of the 197 objectives, or substantiate why they are not applicable. The number of objectives sounds daunting but there is a lot of overlap in the controls that cover each. We see clients have an average of 220 controls to satisfy the 197 objectives. 

A Type 1 report attests to your compliance by design. It’s a snapshot in time that can be achieved by showing you have the right systems and processes in place to satisfy the CSA STAR regulatory clauses.

A Type 2 report attests to your compliance by both design and operation over a period of time. It covers a period between 3-12 months to show your systems and processes have been operated consistently to satisfy the CSA STAR regulatory clauses.

Usually, a Type 1 report is issued first to baseline compliance. That marks the start of the live and recurring Type 2 audit periods for reports issued annually.

No. CSA STAR is designed to be complementary. Level Two accreditation conveniently offers pathways through SOC 2 or ISO 27001 so that you can leverage all of your compliance efforts on those more common standards. CSA STAR can be built on top of either SOC 2 or ISO 270001 following either a certification or attestation report approach so that it is compatible with those two global leading standards and the associated audit firm and/or certification body credentials that accredit those standards.