International
CSA STAR compliance, made simple
ComplianceDesk gives you 50 pre-built CSA STAR controls, an evidence vault, audit-ready reports, and reminders before anything falls overdue — so proving CSA STAR compliance stops being a spreadsheet exercise.
Every CSA STAR control, organised for you
The real control library ComplianceDesk seeds the moment you activate CSA STAR — 50 controls across 17 categories.
Application & Interface Security
- STAR-1.1 Secure software development lifecycle followed
- STAR-1.2 API access controls and security testing implemented
- STAR-1.3 Software supply chain components vetted
Audit Assurance & Compliance
- STAR-2.1 Independent audits performed and reported
- STAR-2.2 Audit logging coverage validated for compliance evidence
- STAR-2.3 Continuous compliance monitoring implemented
Data Security & Privacy
- STAR-3.1 Data classification scheme applied
- STAR-3.2 Encryption applied to data at rest and in transit
- STAR-3.3 Data retention and secure disposal enforced
Identity & Access Management
- STAR-4.1 User access provisioning and de-provisioning controlled
- STAR-4.2 Strong authentication enforced for privileged access
- STAR-4.3 Periodic access recertification performed
Infrastructure & Virtualization Security
- STAR-5.1 Network segmentation implemented in cloud environments
- STAR-5.2 Hypervisor and virtual machine hardening applied
- STAR-5.3 Container and orchestration platform security enforced
Threat & Vulnerability Management
- STAR-6.1 Vulnerability scanning and remediation tracked
- STAR-6.2 Threat intelligence and malware protection maintained
- STAR-6.3 Penetration testing performed on a recurring basis
Supply Chain Management
- STAR-7.1 Third-party and subcontractor risk assessed
- STAR-7.2 Supply chain transparency and accountability disclosed
- STAR-7.3 Right-to-audit clauses included in subcontractor agreements
Business Continuity Management & Operational Resilience
- STAR-8.1 Business continuity plan tested
- STAR-8.2 Backup and restoration capability verified
- STAR-8.3 Business continuity risk assessment performed
Change Control & Configuration Management
- STAR-9.1 Formal change management process enforced
- STAR-9.2 Configuration baselines maintained and monitored for drift
- STAR-9.3 Unauthorized change detection implemented
Cryptography, Encryption & Key Management
- STAR-10.1 Cryptographic key lifecycle managed
- STAR-10.2 Approved cryptographic standards enforced
- STAR-10.3 Key management roles separated from data access roles
Datacenter Security
- STAR-11.1 Physical access to datacenter facilities controlled
- STAR-11.2 Environmental protections implemented at hosting facilities
- STAR-11.3 Equipment identification and asset tracking maintained
Governance, Risk and Compliance
- STAR-12.1 Information security governance structure established
- STAR-12.2 Risk assessments performed and tracked
- STAR-12.3 Regulatory and contractual compliance obligations tracked
Human Resources
- STAR-13.1 Personnel security screening performed
- STAR-13.2 Security awareness training provided to all personnel
- STAR-13.3 Acceptable use and confidentiality obligations enforced
Interoperability & Portability
- STAR-14.1 Data portability supported at contract termination
- STAR-14.2 Standardized interfaces and APIs documented
Logging and Monitoring
- STAR-15.1 Centralized logging implemented across cloud environment
- STAR-15.2 Log integrity and retention protected
- STAR-15.3 Security monitoring and alerting operated
Security Incident Management, E-Discovery & Cloud Forensics
- STAR-16.1 Incident response plan documented and tested
- STAR-16.2 Forensic evidence handling procedures established
- STAR-16.3 Customer notification of security incidents defined
Universal Endpoint Management
- STAR-17.1 Endpoint security baseline enforced
- STAR-17.2 Mobile and remote device management implemented
- STAR-17.3 Endpoint inventory maintained and reconciled
Frequently asked questions
How many controls does ComplianceDesk track for CSA STAR?
50, organised into 17 categories, ready to assign to an owner as soon as you activate the framework.
Can I track CSA STAR alongside other frameworks?
Yes — most teams activate several frameworks at once. Controls that overlap across frameworks can share the same evidence, so you don't collect the same document twice.
How long does it take to set up CSA STAR in ComplianceDesk?
Activating CSA STAR instantly seeds its full control library. Most teams assign owners and get their first controls moving within a day.
Related guides
Other International frameworks
See your full compliance picture
131 frameworks, one system of record.