STAR Certification supplements, and never replaces, ISO/IEC 27001:2022 certification. A STAR certificate is not issued unless the provider has obtained and maintains a valid IAF-accredited ISO/IEC 27001:2022 certification; the ISO scope must be no smaller than the STAR scope; the provider's organisational context must state clearly which functions are in scope; a scope that could mislead a relying party is not allowed; the scope should reflect as closely as possible the full chain of critical activities affecting the provider's data, its users' data and the services; and the information security risk assessment, risk treatment and Statement of Applicability must reflect that scope. If the ISO/IEC 27001 certification lapses, the certification body withdraws the STAR certificate and informs the STAR Registry.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.