CSA STAR Level 2: All About STAR Attestations and Certifications

Any organization providing cloud services can benefit from completing the STAR program’s cloud security and privacy assessments. These assessments are based on the Cloud Controls Matrix (CCM), as well as the privacy requirements for GDPR compliance. STAR assessments fall under two levels of assurance: Level 1 (self-assessments) and Level 2 (third-party assessments). Let’s dive into some of the intricacies of STAR Level 2.

What is CSA STAR Level 2?

STAR Level 2 consists of third-party audits that must be conducted by certified STAR auditors. Level 2 allows organizations to build off of other industry certifications and standards to make them specific for the cloud. STAR Level 1 is a prerequisite for Level 2.

You can choose to complete either STAR Attestation (for SOC 2) or STAR Certification (for ISO/IEC 27001). Your organization’s location, along with the regulations and standards it is subject to, will have the greatest factor in determining which one is appropriate to pursue.

CSA STAR Attestation: For SOC 2

STAR Attestation is a collaboration between CSA and the AICPA to provide guidelines for CPAs to conduct SOC 2 engagements using criteria from the AICPA (Trust Service Principles, AT 101) and the CCM. The renewal period is every 12 months.

CSA STAR Certification: For ISO/IEC 27001

STAR Certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CCM. Certification certificates follow normal ISO/IEC 27001 protocol and expire after 3 years unless updated.

Why You Should Pursue STAR Level 2

STAR Level 2 benefits your organization in several ways:

• Enhanced transparency: STAR provides a public registry where organizations can share their STAR Level 2 results.
• Global recognition: STAR is recognized globally as a trusted security framework. It is aligned with international standards and widely accepted across industries.
• Cloud-specific focus: STAR uniquely focuses on evaluating the security controls and practices of cloud providers.
• Consistency and comparability: STAR follows a consistent assessment and reporting framework developed by CSA. This allows for easier comparison of security practices among different cloud providers.
• Continuous monitoring and improvement: STAR Level 2 includes ongoing monitoring and continuous improvement requirements. This ensures that your security controls are regularly assessed, audited, and updated.
• Customer confidence and competitive advantage: By obtaining STAR Level 2, you can instill confidence in your customers, partners, and stakeholders. It shows that you take information security seriously and have undergone a rigorous assessment by an independent third party.

Steps to Earn STAR Level 2

1. Obtain a SOC 2 Type 2 Attest Report or ISO/IEC 27001 Certification.
2. Complete a STAR Level 1 Self-Assessment. For this, you will need to download and fill out the Consensus Assessment Initiative Questionnaire (CAIQ).
3. Submit your completed CAIQ to the STAR Registry.
4. Prepare for the SOC 2 Attestation or the ISO/IEC 27001 Audit against the CCM. Download the CCM and be sure to read it and understand the content and requirements.
5. Choose a Certified STAR Auditor to conduct your engagement. They will provide you with details regarding pricing, engagement days required, and process. The auditor you select will submit your completed assessment to the STAR Registry for you.
6. Once your auditor makes your submission, both your auditor and the point of contact from your organization will receive a confirmation email.
7. Promote your STAR Level 2 to potential customers by displaying the STAR Level 2 logo on your website. Oftentimes companies will create a page to display their badges and audit reports and then promote their STAR assessment with a hyperlink that goes directly to their submission.

Learn more about the STAR Assessment Portfolio and how to submit to the STAR Registry.

Once you’re ready to earn STAR Level 2, make sure to read the Code of Practice for Implementing STAR Level 2.