CSA STAR
CSA Security Trust Assurance and Risk (STAR) program: L1 Self-Assessment, L2 Certification/Attestation, L3 Continuous.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
CAIQ Question
| Code | Title |
|---|---|
| CAIQ-AIS-01 | Application & Interface Security (AIS) Domain |
| CAIQ-BCR-01 | Business Continuity & Resilience (BCR) Domain |
| CAIQ-CCC-01 | Change Control & Configuration Management (CCC) Domain |
| CAIQ-DSP-01 | Data Security & Privacy Lifecycle (DSP) Domain |
| CAIQ-GRC-01 | Governance, Risk & Compliance (GRC) Domain |
| CAIQ-IAM-01 | Identity & Access Management (IAM) Domain |
| CAIQ-IVS-01 | Infrastructure & Virtualization Security (IVS) Domain |
| CAIQ-NA-1 | Not Applicable Justifications |
| CAIQ-SEF-01 | Security Incident Management, eDiscovery & Forensics (SEF) Domain |
| CAIQ-STA-01 | Supply Chain Management, Transparency & Accountability (STA) Domain |
| CAIQ-STRUCT-1 | CAIQ v4 Structure and Domain Coverage |
| CAIQ-TVM-01 | Threat & Vulnerability Management (TVM) Domain |
L1 Self-Assessment
| Code | Title |
|---|---|
| STAR-L1-1 | Level 1 Self-Assessment Submission |
| STAR-L1-2 | Level 1 Refresh Cadence |
| STAR-L1-3 | Level 1 Signed Attestation Letter |
L2 Attestation
| Code | Title |
|---|---|
| STAR-L2-ATT-1 | Level 2 STAR Attestation (SOC 2 Type II + CCM) |
| STAR-L2-ATT-2 | Level 2 Attestation Period of Coverage |
| STAR-L2-ATT-3 | Level 2 CPA Firm Qualifications |
L2 Certification
| Code | Title |
|---|---|
| STAR-L2-CERT-1 | Level 2 STAR Certification (ISO 27001 + CCM) |
| STAR-L2-CERT-2 | Level 2 Certification Auditor Qualifications |
| STAR-L2-CERT-3 | Level 2 CCM Maturity Scoring |
L3 Continuous
| Code | Title |
|---|---|
| STAR-L3-CONT-1 | Level 3 STAR Continuous Monitoring |
| STAR-L3-CONT-2 | Level 3 Continuous Evidence Sources |
| STAR-L3-CONT-3 | Level 3 Third-Party Validation of Continuous Data |
Program
| Code | Title |
|---|---|
| STAR-CCAK-1 | Certificate of Cloud Auditing Knowledge (CCAK) Alignment |
| STAR-CUST-1 | Customer Due Diligence Use |
| STAR-EVID-1 | CCM Control Evidence Cross-Reference |
| STAR-LEVEL-COMP-1 | Level Selection and Customer Expectations |
| STAR-MAINT-1 | Listing Maintenance and Withdrawal |
| STAR-PROG-1 | STAR Program Foundation on CCM and CAIQ |
| STAR-REG-1 | STAR Registry Public Listing |
| STAR-SCOPE-1 | Scope Statement Requirements |
| STAR-SCOPE-2 | Sub-Service and Carve-Out Treatment |
| STAR-SUB-1 | Submission Package Contents |
| STAR-SUB-2 | CSA Review and Listing Timeline |
Frequently Asked Questions
What is CSA STAR?
CSA STAR is a compliance framework from International with 6 domains and 35 controls. CSA Security Trust Assurance and Risk (STAR) program: L1 Self-Assessment, L2 Certification/Attestation, L3 Continuous. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does CSA STAR have?
CSA STAR has 35 controls organised across 6 domains. The largest domains are CAIQ Question (12 controls), Program (11 controls), L1 Self-Assessment (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does CSA STAR map to?
CSA STAR does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I get started with CSA STAR compliance?
Start your CSA STAR compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CSA STAR requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 35 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.
Get Started Free →Free forever — no credit card required