Cloud Security AssuranceDemonstrate Trusted Cloud Security With STAR
Show that your cloud services meet recognized security best practices through the industry's leading cloud assurance program.
What is STAR?
STAR is CSA’s assurance program for cloud services. It gives organizations a recognized way to document and demonstrate how their cloud services meet security best practices, using the Cloud Controls Matrix (CCM) as the common framework and the STAR Registry as the public record.
Because customers, procurement teams, and regulators increasingly expect evidence of cloud security rather than assertions, STAR serves cloud service providers at any size and stage of maturity, whether they are publishing a first self-assessment or extending an existing ISO/IEC 27001 certification or SOC 2 report with cloud-specific assurance.
Why Choose STAR?
Discover how STAR helps organizations build trust, streamline customer assurance, and differentiate themselves in a competitive cloud market.
Select the benefit that matters most to your organization to see a suggested starting point.
STAR Level 1: Self-Assessment
A published CAIQ documents your security controls and demonstrates transparency without a third-party audit.
STAR Level 1: Valid-AI-ted
Automated validation of your CAIQ adds a Valid-AI-ted badge to your listing for stronger differentiation, without a third-party audit.
STAR Level 2: Certification
Level 2 extends an existing ISO/IEC 27001 certification with cloud-specific controls for stronger independent assurance.
STAR Level 2: Attestation
Level 2 adds cloud-specific assurance to the SOC 2 reporting model already familiar to customers and stakeholders.
Choose Your Level of Assurance
Explore the level of assurance that best matches your organization's maturity, customer expectations, and business objectives.
–
Documents security controls and demonstrates transparency without a third-party audit.
–
Stronger differentiation through automated validation without a third-party audit.
STAR Level 1 Valid‑AI‑ted badge; STAR Registry listing; validation results
Get Listed with this path →Valid-AI-ted CAIQ on the STAR Registry
Extends ISO/IEC 27001 with cloud-specific controls to provide stronger independent assurance.
STAR Level 2 Certification; STAR Registry listing; STAR Level 2 badge
Get Listed with this path →Valid-AI-ted CAIQ on the STAR Registry
Adds cloud-specific assurance to the SOC 2 reporting model already familiar to customers and stakeholders.
STAR Level 2 Attestation; STAR Registry listing; STAR Level 2 badge
Get Listed with this path →Valid-AI-ted CAIQ on the STAR Registry
Demonstrates cloud security assurance aligned with both CSA best practices and Greater China requirements.
STAR Level 2 certification; STAR Registry listing; STAR Level 2 badge
Get Listed with this path →Getting Listed on the STAR Registry
See how your organization moves from preparing for assessment to demonstrating cloud security assurance in the STAR Registry.
Prepare
Review the CCM, determine the appropriate assurance level, and gather the information needed for your assessment.
Complete Your Assessment
Complete the assessment required for your selected STAR level—self assessment for Level 1 or independent third-party assessment for Level 2.
Submit
Submit the required assessment information and supporting materials through the STAR Platform.
Get Listed
Once requirements are met, your organization’s STAR listing is published in the STAR Registry, making your assurance information available to customers and stakeholders.
Maintain & Advance
Keep your listing current and strengthen your assurance over time by maintaining your information for advancing to a higher level.
How Organizations Use STAR
Customers and risk teams can use STAR Registry listings and assessments to evaluate providers, support third-party risk management, streamline procurement, and inform compliance decisions.
Third-Party Risk Management
Use STAR listings and assessment information to evaluate a provider’s security posture and identify areas that may require additional review.
Procurement & Vendor Due Diligence
Incorporate STAR assurance into vendor selection and onboarding to reduce duplicate security reviews and make provider comparisons more consistent.
Supply Chain Risk
Use published assurance information to better understand security responsibilities and risks across cloud and AI service relationships.
Compliance & Assurance Reuse
Leverage STAR controls, mappings, and third-party assurance information to support broader compliance activities and identify where existing assurance may satisfy overlapping requirements.Ready to demonstrate cloud security assurance?
Choose your program and assurance level, then follow the submission path for your route.
What’s Included?
Explore the frameworks, assessments, and supporting resources that make up STAR.
