STAR Level 3 Auditing Scheme

STAR Level 3 aims to provide a framework for the continuous assessment of information systems. The foundation of this process is based on the use of security metrics, where a security metric is defined as a standard for the measurement of the effectiveness of a security control. Organizations undergoing a STAR Level 3 assessment will continuously conduct measurements according to selected metrics and compare the results of these measurements with predefined objectives on a regular basis. An organization that is capable of continuously achieving these predefined objectives will be considered as successful in achieving STAR Level 3.

This framework could be used for simple self-assessments. However, the Cloud Security Alliance aims to build STAR Level 3 as a certification framework, involving the intervention of a certification body. In fact, STAR Level 3 will likely be an extension of the process developed for STAR Level 2, which already requires the intervention of a certification body.