About CSA STAR Certification
The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
Organizations that outsource services to cloud service providers have a number of concerns about the security of their data and information. By achieving the STAR Certification, cloud providers of every size will be able to give prospective customers a greater understanding of their levels of security controls.
The STAR Certification is based upon achieving ISO/IEC 27001 and the specified set of criteria outlined in the Cloud Controls Matrix.
The independent assessment by an accredited CSA certification body will assign a ‘Management Capability’ score to each of the CCM security domains. Each domain will be scored on a specific maturity and will be measured against five management principles.
The internal report will show organizations how mature their processes are and what areas they need to consider improving on to reach an optimum level of maturity. These levels will be designated as either “No”, “Bronze”, “Silver” or “Gold” awards. Certified organizations will be listed on the CSA STAR Registry as “STAR Certified”.
STAR CERTIFICATION evaluates the efficiency of an organization’s ISMS and ensures the scope, processes and objectives are “Fit for Purpose” and helps organizations prioritize areas for improvement and lead them towards business excellence.
It also enables effective comparison across other organizations in the applicable sector and it is focused on the strategic and operational business benefits as well as effective partnership relationships.
CSA STAR Certification enables the auditor to assess a company’s performance, on long-term sustainability and risks, in addition to ensuring they are SLA driven, allowing senior management to quantify and measure improvement year on year.
To be consistent with international standards, the STAR certification scheme is designed to comply with:
- ISO/IEC 17021:2011, Conformity assessment – Requirements for bodies providing audit and certification of management systems
- ISO/IEC 27006:2011, Information technology – Security techniques – Requirements for bodies providing audit and certification of information security management systems
- ISO 19011, Guidelines for auditing management systems
As of March 2015, all CSA STAR Certification assessments are based on CCM v3.x and ISO/IEC 27001:2013.
Whether you use cloud services, provide cloud services, audit/certify cloud services, or secure cloud services, you have a vested interest in knowing more about cloud security from an objective, third-party source. You need the right tools to ensure that you are playing your part in securing the cloud ecosystem while supporting industry standards.
For users of cloud services, CSA STAR helps:
- Get a clear view of cloud provider security practices
- Speed acquisition and improve procurement by accelerating the due diligence process
- Understand which providers complement existing infrastructure
- Maximize long-term investments with vendor transparency
- Gain from lessons learned by a community of cloud users
For cloud service providers, CSA STAR helps:
- Find tools that help build, establish and maintain a robust security program
- Assess their own security with a complementary level one certification
- Educate potential clients on good practices
- Accelerate your sales cycle
- Demonstrate increased cloud computing maturity via additional certification
- Solidify your position as a trusted provider of cloud services to clients
For IT auditors and certification bodies, CSA STAR helps:
- Gain access to guidance to build on existing reporting/standards (SOC2, ISO/IEC 27001) with a cloud specific overlay
- Grow their IT assurance business as a certified leader in cloud-specific security assurance
- Demonstrate expertise by remaining current on best practices, regulations and standards
- Stay apprised of varying maturity levels across the cloud provider and consumer landscape
For security solution providers and consultants, CSA STAR helps:
- Expand business by helping customers successfully navigate secure cloud adoption
- Extend offerings to include data and best practices that support trusted cloud environments
- Become a trusted advisor to your clients for security across the enterprise
- Collaborate with clients as they explore new business models to grow their business
Detailed information about the schema can be found: https://cloudsecurityalliance.org/research/ocf/#_resources
The official launch of the STAR Certification program is the 25th of September 2013.
Submit a Question
Have questions you would like to see answered? Please direct them to [email protected] or through the form below:
Certificate pricing: rules and explanations
The STAR Certification Certificate price is based on the ‘effective number of employees’ in the scope of registration.
The certificate fee covers the issuing of a certificate for a 3-year period. If a certificate is being issued for less than a 3-year period the certification fee will be prorated to the nearest whole month. This means that a client can join half way through an ISO 27001 certification cycle without any penalty and allows us to align the client’s 27001 and STAR Certificates more easily
If a client wishes to increase the number of people in the scope of registration the difference between the fee that would be levied for the existing number of employees and the fee due for the new number of employees will be levied, prorated on the remaining duration of the certificate.
No refund will be given if the number of people in the scope of registration is reduced.
|Effective Employees||Fee (Euros)|
|1 to 10||500|
|11 to 25||1000|
|26 to 75||1750|
|76 to 250||3000|
|251 to 700||5000|
|701 to 1500||7000|
- CSA will apply price reduction based on the World Bank classification.
- CSA will apply a 20% price reduction for CSA Corporate Members.
- The World Bank scale and CSA Members discount cannot be cumulated.
Explanation on the STAR Certificate fee
The revenues from the certificates go to the Cloud Security Alliance that is the governing body of the Open Certification Framework and STAR Program.
The Cloud Security Alliance is a not for profit organization that covers its cost though memberships, sponsorships and royalties generated by the third party commercial exploitation of CSA’s Intellectual Properties and brand.
Through the STAR Certification Certificate fee, the Cloud Security Alliance will:
- cover the cost already sustained in the development of the OCF – STAR Certification,
- manage the STAR web site, which will be the portal where information related to STAR Certification will be displayed. The STAR web site will be also the public window for organizations that will obtain the STAR Certificate,
- organize educational campaigns (conferences, educational material, etc.) to support the penetration of STAR Certification in the market),
- support the improvement and update of Cloud Controls Matrix,
- support the development of OCF Level 3 - STAR Continuous.
Become an Auditor
Requirements on a Certification Body
A certification body conducting CSA STAR Certification assessments shall be accredited to ISO 27006 by an IAF member accreditation body for delivery of ISO 27001 assessments.
- A certification body shall comply with all the requirements of ISO 27006 as well as the document “Requirements for Bodies Providing STAR Certification” in order to qualify as a CSA STAR Certification Body.
- The document “Auditing the Cloud Controls Matrix” adds greater clarity for areas specific to auditing the CCM but does not relieve a Certification Body in its obligation to comply with 27006 when conducting an assessment.
- All assessors must be able to present evidence of passing an accredited lead auditor course for ISO 27001 or be a qualified and experienced ISO 27001 assessor for an IAF member accredited ISO 27001 certification body. Ref 188.8.131.52.1 c in ISO 27006.
- All assessors must have completed a BSI/CSA CCM course. Ref 184.108.40.206.1 c in ISO 27006. For more information on the CSA STAR Certification Training please see: http://www.bsigroup.com/en-GB/CSA-STAR-Certification/CSA-STAR-Certification-Training-/
- assessors must have a minimum of 2 years of experience working in Information Security. Ref 220.127.116.11.1 e in ISO 27006.
- The requirement expressed in the previous clause (2 year of experience working in Info Sec) is not necessary if the assessor has gained the CSA’s Certificate in Cloud Security Knowledge (CCSK) or alternative course that gives a similar level of grounding in cloud computing or information security applications.
|Certified Auditors||Contact Info|
British Standards Institution
BSI Global HQ 389 Chiswick High Road London W4 4AL United Kingdom firstname.lastname@example.org +44 20 8996 9000 BSI Americas 12110 Sunset Hills Road, Suite 200 Reston, VA 20190-5902 Inquiry.email@example.com Telephone: 1.800.862.4977 International offices BSI has 58 offices serving over 80,000 clients in 150 countries To find the office closest to you visit: http://www.bsigroup.com/
Coalfire ISO HQ
Coalfire ISO has locations across the United States and in the United Kingdom. Coalfire ISO is one of a handful of fully-qualified certification bodies in North America accredited by the ANSI-ASQ National Accreditation Board (ANAB). Coalfire ISO is committed to being a value-added, competent, and cost-effective provider of assessment services to national and international standards with the highest integrity and in a timely manner. For more information, please visit http://www.coalfireiso.com
DNV GL HQ Veritasveien 1 1363 Høvik Norway Telephone: +47 67 57 99 00 The Oslo office is the headquarters of DNV GL and more than 1900 employees have their workplace here. Opening hours are 8 am to 4 pm weekdays. On Norwegian holidays the office is closed. To find the office closest to you visit: https://www.dnvgl.com
EY CertifyPoint HQ Antonio Vivaldistraat 150 1083 HP Amsterdam The Netherlands firstname.lastname@example.org://www.ey.com/certifypoint International offices Founded in 2002, EY CertifyPoint is an accredited independent and impartial certification institute with experienced auditors all over the world certifying some of the top international organizations. Being related to the global EY organization, EY CertifyPoint is able to provide you with a local contact person in nearly every country world-wide. For more information, please visit http://www.ey.com/certifypoint.
Nixu Corporation is a cybersecurity company. We work to improve our clients’ cybersecurity in solution areas of Corporate IT, Digital Business and Industrial Internet. Our clients trust Nixu in projects where developing, implementing or assessing of information security is a must. We ensure the confidentiality of our clients’ data, business continuity and ease-of-access to digital services through planning and mitigation of cybersecurity risks.
Schellman & Company, LLC
Schellman & Company, LLC HQ
We are setting the pace and blazing new trails. We are the only company in the world capable of providing our clients the rare opportunity to achieve multiple compliance objectives through a single independent assessor — using experienced teams dedicated to delivering the highest quality.
For more information visit www.schellmanco.com
SN Registrars (Holdings) Ltd is the UKAS Accredited certification body operating under the trading names SNR Certification, DAS Certification and QEC Certification. For more information and locations of our international offices please visit www.snregistrars.com or www.dascertification.com
As regional representatives of DAS Certification, The DAS SEE office combines many years of experience in ISO 27001 and ISO 20000-1 certification within the ICT sector and is the designated program leader for the STAR Certification scheme with contact details below: DAS SEE, agent of SN Registrars (Holdings) Ltd email@example.com www.dascertification.co.uk
Société Générale de Surveillance (SGS)
SGS HQ 1 Place des Alpes P.O. Box 2152 Geneva, 1211 Switzerland SGS Taiwan (East Asia HQ) 4F, No.125, Wu Kung Road, New Taipei Industrial District, New Taipei City, 24886 Taiwan (R.O.C.) International offices SGS has 1,400 offices serving over 120,000 clients certification services in 150 countries. To find the office closest to you visit: http://www.sgs.com/
Certification Competence Center
The TÜV AUSTRIA Deutschland GmbH (TAD) represents the offical Certification-Office of the TÜV AUSTRA GROUP concerning the certification of management-systems for IT-Security like ISO 27001 or CSA STAR. The TÜV AUSTRIA Group is an international group of companies with branches in more than 40 countries and with 1,400 employees worldwide. Services range from testing elevators and pressure equipment, plant safety, training & further education, medical devices, electric engineering, environmental protection, IT security, loss adjustment, certifications, calibrations, technical due diligence, legal compliance checks, and product testing through to the testing of stage and photovoltaic systems as well as wind turbines.
Key Links & Resources
There are a number of control areas on the CCM that will each be awarded a management capability score on a scale of 1-15. This 2nd version release includes alignment with the CCM v1.4 and v3.X.
Release Date: May 16, 2014
The following guidelines will help you to apply good practice in publicizing, communicating and promoting your certification to stakeholders, including staff, customers and business partners, and to the general public.
Release Date: September 03, 2013
This document outlines how to conduct a STAR certification assessments to the Cloud Controls Matrix (CCM) as part of an ISO 27001 assessment.
Release Date: September 03, 2013
The CSA Open Certification Framework is a program for flexible, incremental and multi-layered cloud provider certification according to the Cloud Security Alliance’s industry leading security guidance and control objectives.
Release Date: August 17, 2012