CSA STAR Certification – Q&A Session

Originally published by MSECB.

1. What is the CSA STAR Certification?

The CSA STAR (Security, Trust, and Assurance Registry) Certification is a program launched by the Cloud Security Alliance (CSA) in 2011 that provides independent third-party assessment and certification of the security measures and controls implemented by cloud service providers (CSPs) against the CSA's Cloud Controls Matrix (CCM).

2. Why is CSA STAR Certification important for organizations?

CSA STAR Certification is important for organizations as it helps them verify the security and compliance measures implemented by their CSPs. It is a rigorous process that ensures the scope is “fit for purpose” and “SLA Driven” and can help users make informed data-driven decisions when selecting a CSP and meet their regulatory and compliance obligations.

3. What are the benefits of CSA STAR Certification for CSPs?

The benefits of CSA STAR Certification for CSPs include:

• Enhanced market visibility and credibility.
• Increased customer confidence.
• Ability to differentiate themselves from their competitors.
• Identify and address security gaps and risks.
• Improvement of their overall security posture by benchmarking themselves against other CSPs.

4. How does CSA STAR Certification work?

CSA STAR Certification works by providing a framework for independent third-party assessment and certification of a CSP's security and compliance measures against the CSA's CCM. CSPs are required to undergo a comprehensive assessment and provide evidence of their compliance with the CCM requirements. CSA STAR is based on an “extension to scope” to ISO/IEC 27001 (STAR Certification) and/or SOC 2, STAR Attestation (STAR Attestation).

In terms of STAR Certification, an organization must be ISO/IEC 27001 certified, conduct an extension to scope exercise by evaluating compliance with the CCM through the SOA, and then be audited by a CSA-approved assessment firm like MSECB to perform an extension to scope audit integrated with ISO/IEC 27001. STAR Certification also includes a maturity model assessment that provides organizations with a detailed analysis of their strengths and weaknesses in each domain.

5. What are the different levels of CSA STAR Certification?

Currently, there are two levels of CSA STAR Certification: Level 1 and Level 2.

Level 1 is a self-assessment based on the CSA CCM, while Level 2 is a third-party assessment based on the CSA CCM and additional requirements. STAR Level 3, provides an additional level of assurance by providing real-time continuous auditing and eventually continuous certification.

6. What are STAR certification and STAR attestation? Can you have both?

STAR Certification is the formal certification process that is conducted by an accredited third-party certification body as an extension to the scope of ISO/IEC 27001 certification, while STAR Attestation is a formalized audit process that is conducted by a CPA firm as an extension to SOC 2 Type II. A CSP can have both STAR Certification and STAR Attestation.

7. What are some of the security domains covered by CSA CCM for CSA STAR Certification, and is it related to other cloud security framework standards?

There are 17 security domains covered by the CSA CCM for CSA STAR Certification, which include:

The CSA CCM is related to other cloud security framework standards, such as ISO/IEC 27001, NIST SP 800-53, and many others. Those mappings are included in the CCM document.

8. Can organizations customize the CCM to fit their specific security needs and requirements?

Yes, organizations can customize the CCM to fit their specific security needs and requirements, as long as the modifications do not compromise the overall effectiveness and comprehensiveness of the CCM and/or the management system.

9. Which organizations should pursue STAR Level 2 certification?

Cloud Service Providers (CSPs) that are required to comply with industry or regulatory standards or mandates or those that handle sensitive data or critical business processes should pursue STAR Level 2 certification. For users, it allows them to evaluate the security posture and compliance of their CSP(s) and can also serve as a tool that CSCs can use to confirm they are aligned with their CSP in terms of shared responsibility.

10. How is CSA STAR related to ISO/IEC 27001, and is it necessary for an organization to be certified with ISO/IEC 27001 before seeking CSA STAR Certification?\

CSPs must have ISO/IEC 27001 certification before pursuing CSA STAR Level 2 Certification, as CSA STAR builds upon the ISO/IEC 27001 standard and requires additional controls and requirements. However, if you are not yet ISO/IEC 27001 certified, you can pursue both at the same time.

11. What are some tips and advice to get ready for a certification audit against CSA STAR?

Some tips and advice to get ready for a certification audit against CSA STAR include:

• Thoroughly reviewing the CSA CCM and understanding its requirements.
• Conducting a gap analysis to identify any areas of non-compliance or improvement opportunities using the CSA STAR Level 1 Self-assessment.
• Establishing a formal security program and policies.
• Conducting regular risk assessments and security testing.
• Maintaining clear and detailed documentation of all security measures and controls implemented.

It is also required to engage a reputable third-party auditor with experience in CSA STAR Certification and who has been approved by CSA.

About the Responder

John DiMaria (CSSBB, HISP, MHISP, AMBCI, CERP) is the STAR Program Director and Research Fellow with the Cloud Security Alliance. He has 30 years of experience in standards and management system development, including Information Systems, Business Continuity, and Quality.

Mr. DiMaria was one of the innovators and co-founders of the CSA STAR program for cloud providers. He is a contributing author of the American Bar Association’s Cybersecurity Handbook, a working group member, and a key contributor to the NIST Cybersecurity Framework. He currently manages all facets of the CSA STAR Program, which includes security, privacy, continuous monitoring, customer technical support, and the development of new solutions.