CSA STAR (Security, Trust, Assurance, and Risk) L2-CYCLE: Follow the ISO/IEC 27001 audit cycle for the CCM assessment, surveillance and recertification

The CCM assessment follows the ISO/IEC 27001:2022 cycle. A provider certifying to both for the first time has an initial assessment covering both, then surveillance visits that together cover the full range of ISO/IEC 27001 and the CCM over three years, and a recertification assessment at the end of the cycle. A provider adding STAR to an existing ISO certification has the full applicable CCM control set audited at the first visit, which can be any type of visit if the extra time is added. Certificates follow normal ISO protocol and expire after three years unless renewed; a transfer of a STAR certificate between bodies follows IAF MD 2:2023, with the accepting body checking that the issuing body met the certification body requirements.