Compliance · Cloud assurance
The public registry cloud buyers check before they call you.
CSA STAR is the Cloud Security Alliance's assurance program for cloud providers, built on the Cloud Controls Matrix. A STAR Registry listing is public, free to search, and increasingly the first place enterprise cloud buyers look during vendor selection.
CCM
Control basis
L1 / L2
Assurance levels
Public
Registry listing
Two levels of assurance built on the same underlying control matrix.
The CCM is CSA's cloud control framework, mapped to ISO 27001, SOC 2, NIST, PCI DSS and more — so answering it once feeds several obligations.
You complete the CAIQ (the CCM as a questionnaire) and publish it to the registry. It's free, fast, and a credible first step — but it is self-asserted.
Independent validation, achieved as STAR Certification alongside ISO 27001 or STAR Attestation alongside SOC 2. This is what enterprise buyers actually weigh.
Cloud and SaaS providers selling into security-conscious organizations.
We do the readiness, build and run the controls, and support you through the audit — we are not the auditor, and we keep that separation deliberate.
We assess your controls against the Cloud Controls Matrix and identify what's real versus aspirational.
We complete the CAIQ accurately — overstating answers on a public registry is a risk, not a shortcut.
We get you published on the STAR Registry so buyers can find the evidence themselves.
We prepare you for STAR Certification (with ISO 27001) or Attestation (with SOC 2), reusing that work.
We turn your CCM answers into a reusable response kit that kills weeks of questionnaire toil.
We keep the listing current as your environment changes — a stale CAIQ is worse than none.
Measure real control coverage.
Answer accurately, with evidence behind each claim.
List on the STAR Registry.
Certification with ISO 27001 or attestation with SOC 2.
Refresh as the environment and standards evolve.
Yes, as a starting point — it's free, public, and shows you'll put your answers on the record. But sophisticated buyers know it's self-asserted. Treat Level 1 as the on-ramp and Level 2 as the destination.
Effectively yes. STAR Certification is performed alongside an ISO 27001 audit; STAR Attestation alongside a SOC 2 engagement. STAR Level 2 rides on one of those, which is why we sequence them together rather than separately.
The CCM ships with mappings to ISO 27001, SOC 2, NIST, PCI DSS and others. That's its real leverage — assess once against the CCM and reuse the answers across multiple obligations instead of restarting each time.
Most of the work transfers. Once controls are mapped and evidenced, a second framework costs a fraction of the first.
Tell us where you are and who’s asking for it — we’ll come back with scope, gaps, and a realistic timeline.