The Security Trust Assurance and Risk (STAR) Program encompasses key principles of transparency, rigorous auditing, and harmonization of standards. Companies who use STAR indicate best practices and validate the security and privacy posture of their cloud offerings.
Origin of the STAR Registry
The STAR Program was originally designed to provide both CSPs and customers with a framework for cloud security assurance and compliance.
With the introduction of the GDPR Code of Conduct, CSA has taken a first step towards the extension of STAR to Privacy.
Security and Privacy are two foundational aspects and requirements of a trusted cloud environment, they walk hand-in-hand and mutually support each other in achieving this goal.
From the compliance perspective, security represents a key enabler of privacy, a necessary foundation that allows companies to protect personal data.
The CSA STAR Program provides:
- Technical standards, i.e. Cloud Control Matrix (CCM) and GDPR Code of Practice
- Certification schemes and adherence mechanisms
- A public registry
The joint adoption of both our Security and Privacy standards and certification/attestation provides CSPs with a compliance suite for both legal and technical security requirements of GDPR.
Submitting a Self Assessment
For the submission of your Code of Conduct Self Assessment please submit the following documents through the CSA STAR Registry
The current version of the CSA Code of Practice is 3.2 (which replaces 3.1), the updates were to be in compliance and align with the Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 adopted February 12, 2019.
The third-party certification, which will be available in Q4 2019, covers the same scope of the Self Assessment, but rather than being a self-attestation of the adherence to the requirements of the Code (and consequently of the GDPR), is based on a thorough audit performed by a qualified assessor. During the audit the qualified assessor will verify the correct implementation of CoP Requirements and the accuracy of information included in CoP Template.
CSA Code of Conduct for GDPR Compliance Trust Marks
Promoting Transparency and assurance, organizations complying with CSA Code of Conduct for GDPR Compliance can apply for an official trust mark.
CSA Code of Conduct for GDPR Compliance Declared
The “Declared” mark is given to services and/or providers that have fulfilled the self-assessment process for the CSA Code of Conduct for GDPR Compliance requirements.
CSA Code of Conduct for GDPR Compliance Certified
The “Certified” mark is given to services and/or providers which provide evidence of compliance with the CSA Code of Conduct for GDPR Compliance requirements by means of third party certification.
Submit to the STAR Registry
The industry's most powerful program for security assurance in the cloud.
File a Complaint
File a complaint in order to bring to the attention of the Cloud Security Alliance: a violation of the GDPR Code of Conduct Certification,
Submit to Registry
Submit to CSA’s Security, Trust, Assurance, and Risk (STAR) Registry to verify your level of privacy and security on the cloud.
Get the Code of Conduct
CSA Code of Conduct for GDPR Compliance provides a consistent and comprehensive framework for complying with the EU’s GDPR.