CSA STAR Level 1 and Level 2 for cloud and AI providers.
CSA STAR is the Cloud Security Alliance’s assurance program for cloud services. Providers publish their security posture in the public STAR Registry, and enterprise buyers check it during procurement. Level 1 is a self-assessment questionnaire, the CAIQ (Consensus Assessments Initiative Questionnaire). Level 2 adds an independent audit.
An extension of your SOC 2 program.
STAR Level 2 Attestation is a SOC 2 audit that also tests the Cloud Controls Matrix, so it builds directly on our SOC 2 work. We map your controls to the CCM, close the gaps, and prepare you for the combined audit with the CPA firm you choose.
For Level 1, we prepare the CAIQ answers and evidence with your team, and your company submits them to the STAR Registry.
A self-assessment, or an audit that includes the Cloud Controls Matrix.
CSA also runs STAR for AI, which uses the AI Controls Matrix for companies that build AI services.
CSA STAR questions.
Which level do buyers ask for?
We already have SOC 2. What does Level 2 add?
Is CCM v4.0 still accepted?
Buyer asking for CSA STAR?
On a scoping call we’ll tell you which level fits and what it will take.