Assurance ProgramSecurity, Trust, Assurance & Risk (STAR) Program
The industry-leading assurance program for cloud and AI.
Valid-AI-ted — Silver recognition for Best AI-powered Compliance Solution
AI Controls Matrix (AICM)
What is the STAR Program?
CSA’s STAR Program is the industry-leading assurance program for cloud and AI. Whether you're demonstrating security, evaluating providers, or implementing trusted frameworks, CSA provides the path to stronger security assurance.
Learn how the STAR Program brings together cloud and AI security frameworks, assessments, and publish assurance listings into one trusted ecosystem.
Explore the Programs
Compare STAR and STAR for AI to understand which assurance program best aligns with your organization's services and security goals.
Demonstrate the security of your cloud services through self-assessment or independent third-party assurance.
Explore STAR →
Show customers and stakeholders that your AI systems meet recognized security and governance expectations.
Explore STAR for AI →The STAR Program in Practice
See how organizations have leveraged the STAR Program to strengthen their assurance practices and overall security posture.
The Role of CSA STAR in Vendor Security Assessments
Explore how CSA STAR helps organizations streamline vendor security assessments, reduce questionnaire fatigue, and improve third-party risk visibility.
Read the full case study →How CSA STAR Helps Cloud-First Organizations Tackle Modern Identity Security Risks
Explore how CSA STAR helps cloud-first organizations address identity sprawl, excessive privileges, and fragmented access controls.
Read the full case study →CSA Community Spotlight: Auditing Cloud Security with CEO David Forman
Learn how CSA STAR, the CCSK credential, and global standards support cloud security auditing and certification.
Read the full case study →What are you trying to accomplish?
Choose your objective to find the right tools, guidance, and next steps within the STAR ecosystem.
Get Listed
Begin your first STAR or STAR for AI submission and publish an assurance listing in the STAR Registry.
Get StartedUpgrade my Listing
Advance to a higher level of assurance, add STAR for AI, or add Valid-AI-ted to an existing listing.
Evaluate Organizations
Search the STAR Registry to compare listed organizations and better understand their assurance level.
Search the STAR RegistryExplore Frameworks & Resources
Browse the CCM, AICM, submission guides, prep kits, and training that support STAR Program participation.
Browse resourcesThe STAR Ecosystem
Understand how the STAR Program’s frameworks, assessments, and Registry work together to support your organization's assurance journey.
Frameworks
ToolsAssurance paths
Programs and RegistryFrameworkCloud Controls Matrix (CCM)
The Consensus Assessments Initiative Questionnaire captures how your cloud service implements each CCM control. It is the submitted artifact for STAR Level 1 and supports Level 2.
Connects to
FrameworkAI Controls Matrix (AICM)
A vendor-neutral framework for building secure, responsible, and well-governed AI systems. AICM controls are the basis of every STAR for AI assessment.
Connects to
ToolCAIQ
The Consensus Assessments Initiative Questionnaire captures how your cloud service implements each CCM control. It is the submitted artifact for STAR Level 1 and supports Level 2.
Connects to
ToolAI-CAIQ
The AI questionnaire captures how your AI service implements each AICM control. It is the submitted artifact for STAR for AI Level 1 and Level 2.
Connects toToolValid-AI-ted
Automated validation of a CAIQ or AI-CAIQ submission that returns scoring and improvement guidance, and adds a Valid-AI-ted badge to your Registry listing.
Connects to
Assurance pathSelf-assessment. Submit the CAIQ directly, or submit it through Valid-AI-ted for automated scoring and a Valid-AI-ted badge.
Connects to
Assurance pathSTAR Level 2
Third-party audit. Certification (ISO/IEC 27001), Attestation (SOC 2), or C-STAR for the Greater China market, each combined with a CAIQ submission.
Connects to
Assurance pathSTAR for AI Level 1
Self-assessment for AI services. Submit the AI-CAIQ directly, or through Valid-AI-ted for automated scoring and a badge.
Connects to
Assurance pathSTAR for AI Level 2
Third-party assurance for AI services across ISO/IEC 27001, ISO/IEC 27001 + 42001, ISO/IEC 42001, and SOC 2 routes — each paired with an AI-CAIQ passed through Valid-AI-ted.
Connects to
Programs and RegistrySTAR
Cloud security assurance. Demonstrate the security of your cloud services through self-assessment or independent third-party assurance.
Connects to
Programs and RegistrySTAR for AI
AI security assurance. Show customers and stakeholders that your AI systems meet recognized security and governance expectations.
Connects to
Programs and RegistrySTAR Registry
The public registry of organizations demonstrating cloud and AI security assurance. Your listing, level, badges, and submitted artifacts are published here.
Connects to
Third-Party Certifications & Assurance
Organizations can display additional third-party certifications and assurances on their STAR Registry listing. Each is issued and maintained by its own governing body, and appears alongside your STAR or STAR for AI assurance to give customers a fuller view of your security posture.
AIUC-1
Third-party AI assurance standard covering AI system safety, security, and reliability.
Learn more →
EU Cloud CoC
GDPR code of conduct for cloud services, verifying data protection commitments for EU customers.
Learn more →
ISO/IEC 42001
International standard for AI management systems, demonstrating governance over AI development and use.
Learn more →
AARM
System category specification for agentic runtime security. Defines the capabilities required to govern AI agent actions at runtime.
Learn more →Featured Guidance & Resources
Start exploring the most widely used frameworks, guidance documents, and training that support STAR Program participation.
Framework
Framework
Prep KitRelated STAR Programs & Services
Start exploring the most widely used frameworks, guidance documents, and training that support STAR Program participation.
Become a STAR Enabled Solution
Recognition for solutions that help organizations implement and maintain STAR assurance.
Learn more →
Explore Certified STAR Auditors
Find approved certification bodies and assessment firms for Level 2 engagements.
Find an auditor →
Unlock GDPR-Compliant Cloud Services with CSA and EU Cloud CoC
Data protection compliance for cloud services through the EU Cloud Code of Conduct.
Learn more →