Services

CSA STAR Certification

CSA STAR is the Cloud Security Alliance's assurance program for cloud providers, built around the Cloud Controls Matrix — a detailed set of cloud-specific security controls — with multiple levels of assurance: a self-assessment published in the STAR Registry, a third-party certification (STAR Certification, which layers onto ISO 27001), and a continuous monitoring level for organizations that want to demonstrate ongoing, not point-in-time, assurance.

What makes STAR useful, compared to some frameworks, is that it's specifically built for cloud service delivery rather than being a general security standard adapted after the fact. The Cloud Controls Matrix maps cleanly to other frameworks your customers might also ask about — ISO 27001, SOC 2, GDPR — which means a lot of the underlying evidence can be reused rather than rebuilt separately for each one.

Picking the right level

A lot of organizations default to the self-assessment because it's free and fast, which is a reasonable starting point, but it carries less weight with customers who need independent verification. If you're routinely fielding detailed security questionnaires from enterprise customers, the certified level is usually worth the investment because it answers most of those questionnaires for you, once.

How I'd approach this with you

I'd start by mapping what you already have — especially if you're ISO 27001 certified already, since STAR Certification builds directly on that — against the Cloud Controls Matrix, then close the cloud-specific gaps that remain. If you're starting from nothing, it often makes sense to pursue ISO 27001 and STAR together rather than sequentially.

If you're trying to figure out which STAR level actually matches what your customers are asking for, let's talk it through.