A body conducting STAR Certification must be a CSA corporate member in good standing, accredited to ISO/IEC 17021-1:2015 by an IAF member accreditation body for ISO/IEC 27001:2022 certification, and must follow CSA's requirements together with ISO/IEC 17021-1 and ISO/IEC 27006 or ISO/IEC 27006-1:2024 (bodies had to be ready by 31 December 2024, use 27006-1 for initial or extension accreditation assessments from 31 March 2025 and complete the transition by 31 March 2026). Its auditors must be approved ISO/IEC 27001:2022 auditors with knowledge of the cloud services sector and cloud technical knowledge shown by the CCSK, Certified CSA STAR Auditor, CCAK or an equivalent certificate. An initial CCM audit adds at least 50% to the ISO/IEC 27001 initial audit time, with surveillance adjusted and sampling allowed as in ISO/IEC 27006, and the combined audit must not cut the time normally allocated to ISO/IEC 27001, while avoiding duplicated effort where the two overlap.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.