CSA STAR (Security, Trust, Assurance and Risk) is the Cloud Security Alliance's assurance program specifically for cloud service providers — and it's worth knowing about because, unlike almost every other framework on this list, its first level is genuinely free and doesn't require an external audit at all.
Built around the Cloud Controls Matrix (CCM)
STAR is anchored on the Cloud Controls Matrix — a cybersecurity control framework purpose-built for cloud computing, organised into control domains covering things like application and interface security, data security and privacy, identity and access management, and infrastructure and virtualisation security. The CCM is also explicitly mapped to other major standards (including ISO 27001, NIST, and PCI DSS), which is what makes STAR genuinely useful alongside frameworks you may already hold rather than a completely separate program.
Level 1: Self-assessment on a free, public registry
This is STAR's most distinctive feature. A cloud provider can complete the Consensus Assessments Initiative Questionnaire (CAIQ) — a standardised set of yes/no questions mapped to the CCM — or publish a completed CCM assessment, and submit it to the public STAR Registry at no cost. Prospective customers can search the registry directly to see a provider's self-reported security posture before ever starting a sales conversation. For an early-stage SaaS company that isn't ready for the cost of a SOC 2 audit or ISO 27001 certification yet, this is a genuinely accessible way to demonstrate security maturity publicly.
Level 2: Third-party certification, built on standards you may already hold
Level 2 requires independent third-party validation, and comes in two forms that deliberately build on existing frameworks rather than reinventing one:
- STAR Certification — combines ISO/IEC 27001 with the CCM's cloud-specific control requirements, assessed by an accredited certification body. If you're already pursuing ISO 27001, this can be a meaningful incremental step rather than a separate audit from scratch.
- STAR Attestation — combines SOC 2 with the CCM, performed by a licensed CPA firm. The natural next step if SOC 2 is already your primary assurance report.
Level 3: Continuous monitoring
STAR also defines a Continuous (sometimes called STAR Continuous) tier, aimed at near-real-time or frequent validation of security posture rather than a point-in-time or annual assessment. It's the newest and least universally adopted tier — worth knowing exists, but Level 1 and Level 2 are what most cloud providers and their customers actually reference today.
Why customers ask for it specifically
Enterprise procurement and security teams evaluating cloud vendors increasingly look for STAR Registry entries as a quick, structured way to compare providers using a common control taxonomy, rather than reading each vendor's security page and hoping it's comprehensive. Being listed — even at Level 1 — gives a concrete, checkable answer to "what's your cloud security posture" instead of a sales deck claim.
This guide is general information — the specific level and assessment type most relevant to your business depends on your customers' requirements and which underlying framework (ISO 27001 or SOC 2) you're already pursuing or hold.
Building on controls you're already tracking
Because the CCM maps so directly onto ISO 27001 and SOC 2 control areas, ComplianceDesk's CSA STAR framework lets you reuse evidence you're already collecting for those frameworks against the CCM's own control domains — so pursuing STAR alongside an existing ISO 27001 or SOC 2 program doesn't mean starting the evidence-collection exercise over again.