Where a provider's ISO/IEC 27001:2022 certificate comes from a body not accredited by CSA and the provider does not move it, a CSA-accredited body may still issue STAR Certification after documented due diligence: validating the risk assessment and Statement of Applicability; confirming the ISO certificate falls within the other body's accredited scope, covers the cloud service and the sites, and that body is accredited by an IAF member; recording why a separate body is used; reviewing the latest initial or recertification and surveillance reports and open nonconformities (certification is denied if they are unavailable or overdue), complaints and the audit programme. Such a STAR audit is expected to take no fewer days than a full ISO/IEC 27001 initial audit, and every STAR certificate references the unique identifier of the ISO/IEC 27001 certificate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.