CSA STAR (Security, Trust, Assurance, and Risk) L2-CCM: Treat the CCM as additional ISMS controls, justify exclusions and evidence controls over time

In a STAR Certification the CCM controls are treated as additional controls under ISO/IEC 27001:2022 clause 6.1.3 b. A control area may be excluded only with justification as the standard requires for the Statement of Applicability, and compensating controls are accepted where there is enough evidence that they give the same coverage as the original control. There must be evidence that each control has been in place and effective, which usually means about three months of operation unless effectiveness can be shown over a shorter period.