CSA STAR, prove your cloud security openly
Publish your cloud security posture in a public registry, from self-assessment to third-party certification.
Official sources
Use these official places to read the text and find the latest version.
Official website
The Cloud Security Alliance runs the registry and publishes the control matrix.
Visit cloudsecurityalliance.org/star ↗Get the document
The Cloud Controls Matrix and the questionnaire are free to download.
Open the official page ↗What CSA STAR is
STAR is the Cloud Security Alliance’s programme for showing how well a cloud provider protects customers. It uses the Cloud Controls Matrix, a list of cloud security controls.
Providers can start with a self-assessment and move to third-party audit and continuous monitoring.
How CSA STAR got to where it is today
The milestones that changed what organisations have to do.
CSA founded
The Cloud Security Alliance is formed in December 2008 as a coalition for cloud security guidance.
STAR launched
The registry opens, starting with self-assessment.
CCM v4
The Cloud Controls Matrix is updated.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You sell cloud services to businesses.
Customers send long security questionnaires.
You want a public, credible signal.
You already hold ISO 27001 and want to go further.
What it asks of you
The requirements fall into six areas.
Level 1: self-assessment
Publish answers to the questionnaire.
Level 2: third-party audit
An auditor assesses against the matrix.
Continuous monitoring
Show controls working over time.
Cloud Controls Matrix
Controls in grouped domains.
Mapping to standards
Matrix maps to other frameworks.
Registry listing
A public entry for customers.
The 6 domain groups, 20 domains and programme areas and 89 controls and requirements
The Cloud Controls Matrix groups 197 control objectives into 17 domains. This page shows the programme levels and a selection of key controls in each domain; STAR is how providers prove they meet them.
20 domains · 89 controls
STAR programmeHow the CCM is used to assure a cloud service, from self-assessment to third-party audit.3 domains · 5 controls
STAR-L1STAR Level 1 (self-assessment)The provider answers the CCM-based questionnaire (CAIQ) and publishes it.2 controls
- STAR-L1
The cloud provider assesses itself against the CCM using the Consensus Assessments Initiative Questionnaire and publishes the result in the STAR Registry.
What you do
- Answer the CAIQ with named owners and evidence references
- Review and republish annually or on major change
- STAR-L1-CCM
The provider treats the CCM as the baseline for deciding which security and privacy controls it must have and be able to explain to customers.
What you do
- Map existing policies and controls to the 17 domains
- Record gaps with owners and dates
Evidence to keep
- Completed CAIQ v4
- Registry entry
- Internal sign-off of answers
STAR-L2STAR Level 2 (third-party assurance)An independent auditor tests the controls, on top of an existing audit scheme.2 controls
- STAR-L2-ATT
STAR Attestation: a licensed CPA firm extends a SOC 2 examination to include CCM criteria and issues a report.
What you do
- Choose a SOC 2 auditor approved for STAR and agree CCM scope
- STAR-L2-CERT
STAR Certification: an accredited certification body extends an ISO/IEC 27001 audit to include CCM controls and issues a certificate.
What you do
- Add the CCM mapping to the ISO 27001 statement of applicability
Evidence to keep
- Auditor report or certificate
- Scope and CCM mapping
- Registry entry
STAR-CTRLUsing the CCM in practiceCustomers and providers use the CCM to share responsibilities and compare services.1 control
- STAR-SSRM
The CCM allocates control ownership between provider and customer, so each side knows which controls it implements.
What you do
- Fill in who owns, shares or inherits each control for the service
Evidence to keep
- Shared security responsibility model
- Completed customer questionnaires
Governance, assurance and peoplePolicy, risk, audit, suppliers and staff controls.4 domains · 18 controls
A&AAudit and Assurance (6 control objectives)Plan, run and fix independent assessments.4 controls
- A&A-01
Audit and assurance policies and procedures exist, are approved and reviewed at least yearly.
What you do
- Write and review an audit policy
- A&A-02
Independent assessments of the organisation's security are performed at least annually against relevant standards.
What you do
- Commission an annual independent review
- A&A-04
The organisation verifies compliance with applicable standards, regulations and contracts.
What you do
- Keep a compliance mapping and test it
- A&A-06
Audit findings are remediated with defined tracking and status reporting.
What you do
- Track findings to closure and report status
Evidence to keep
- Audit plan
- Audit reports
- Remediation tracker
GRCGovernance, Risk and Compliance (8 control objectives)Programme, policy and risk management.5 controls
- GRC-01
A governance programme with approved policies and procedures is established and reviewed.
What you do
- Maintain a policy suite with annual review
- GRC-02
A formal risk management programme assesses and treats risks regularly.
What you do
- Run annual and event-driven risk assessments
- GRC-04
A process handles exceptions to policy and approves them.
What you do
- Record exceptions, expiry and approver
- GRC-05
An information security programme covering all CCM domains is developed and implemented.
What you do
- Appoint a security lead and plan
- GRC-07
Applicable legal, statutory and regulatory requirements are identified and mapped to the systems and services.
What you do
- Keep a regulatory register
Evidence to keep
- Policy set with version history
- Risk register
- Regulatory mapping
STASupply Chain Management, Transparency and Accountability (14 control objectives)Shared responsibility and supplier oversight.5 controls
- STA-01
Policies cover the shared security responsibility model between provider, customers and suppliers.
What you do
- Publish a responsibility matrix
- STA-07
A current inventory of supply chain relationships is maintained.
What you do
- Keep a supplier register with criticality
- STA-09
Contracts for the primary service define scope, roles, security and compliance obligations.
What you do
- Use standard security schedules
- STA-11
Internal compliance testing covers supply chain controls.
What you do
- Test supplier controls at least yearly
- STA-14
Data security assessment is performed on supply chain partners.
What you do
- Assess suppliers that process data
Evidence to keep
- Shared responsibility documentation
- Supplier inventory
- Supplier agreements and reviews
HRSHuman Resources (13 control objectives)Screening, agreements, training and exit.4 controls
- HRS-01
Background screening of candidates is performed in line with law and risk.
What you do
- Screen before access is granted
- HRS-06
Procedures cover employment termination or change and return of assets.
What you do
- Run a leaver checklist including access removal
- HRS-10
Confidentiality agreements reflect the organisation's needs and are reviewed.
What you do
- Review NDAs yearly
- HRS-11
Security awareness training is provided to all staff and updated regularly.
What you do
- Provide induction and annual training
Evidence to keep
- Screening records
- Signed agreements
- Training records
Data protection and cryptographyData lifecycle, privacy, keys and portability.3 domains · 16 controls
DSPData Security and Privacy Lifecycle Management (19 control objectives)Classify, protect, retain and dispose of data.8 controls
- DSP-02
Data is disposed of securely so it cannot be recovered.
What you do
- Use certified wiping and certificates of destruction
- DSP-03
A data inventory is created and maintained.
What you do
- Record data types, locations and owners
- DSP-04
Data is classified by type, sensitivity and criticality.
What you do
- Apply a classification scheme
- DSP-05
Data flows within the service are documented.
What you do
- Keep data flow diagrams current
- DSP-07
Data protection is applied by design and by default.
What you do
- Include data protection in design reviews
- DSP-10
Transfers of sensitive data are protected and comply with law.
What you do
- Control cross-border transfers
- DSP-16
Data retention and deletion follow policy, law and contract.
What you do
- Automate deletion at the end of retention
- DSP-19
Customers can know and control the location of their data.
What you do
- Offer region selection and document locations
Evidence to keep
- Data inventory and classification
- Data flow diagrams
- Privacy impact assessments
- Retention schedule
CEKCryptography, Encryption and Key Management (21 control objectives)Encrypt data and manage keys through their life.6 controls
- CEK-01
Encryption and key management policies are established and reviewed.
What you do
- Write a cryptography standard
- CEK-03
Data at rest and in transit is protected with approved cryptography.
What you do
- Enforce TLS and disk or database encryption
- CEK-04
Encryption algorithms are appropriate to data classification and risk.
What you do
- Use current approved algorithms
- CEK-08
Customers can manage their own encryption keys where appropriate.
What you do
- Offer customer-managed keys
- CEK-12
Keys are rotated according to policy.
What you do
- Automate rotation
- CEK-21
A key inventory is maintained.
What you do
- Record keys, owners and purpose
Evidence to keep
- Cryptography policy
- Key inventory
- Key rotation logs
IPYInteroperability and Portability (4 control objectives)Open interfaces and data portability.2 controls
- IPY-02
Application interfaces are available to customers using standard formats.
What you do
- Publish documented APIs
- IPY-04
Contracts address data portability and exit.
What you do
- State export formats and timelines
Evidence to keep
- API documentation
- Exit and portability terms
Access, endpoints and facilitiesWho can reach what, from which devices and places.3 domains · 17 controls
IAMIdentity and Access Management (16 control objectives)Identity lifecycle, privilege and authentication.8 controls
- IAM-01
Identity and access management policies and procedures are in place.
What you do
- Write and review an access standard
- IAM-04
Separation of duties is applied to avoid conflicting access.
What you do
- Define toxic role combinations
- IAM-05
Least privilege is enforced.
What you do
- Grant minimum access by role
- IAM-06
User access is provisioned through an authorised process.
What you do
- Use ticketed approvals
- IAM-07
Access is changed or revoked on role change or exit.
What you do
- Remove access on the leaving date
- IAM-08
User access is reviewed periodically.
What you do
- Review quarterly for sensitive systems
- IAM-10
Privileged access roles are managed and limited.
What you do
- Use just-in-time elevation
- IAM-14
Strong authentication including multi-factor is used.
What you do
- Enforce MFA for all admin and remote access
Evidence to keep
- Access policy
- Access review records
- MFA coverage report
UEMUniversal Endpoint Management (14 control objectives)Managed, protected endpoints.5 controls
- UEM-04
An inventory of endpoints that access systems is maintained.
What you do
- Use device management software
- UEM-08
Endpoint storage is encrypted.
What you do
- Enforce full disk encryption
- UEM-09
Anti-malware protection is installed and kept current.
What you do
- Deploy endpoint protection with alerts
- UEM-11
Data loss prevention is applied to endpoints.
What you do
- Restrict removable media and uploads
- UEM-13
Lost or stolen devices can be wiped remotely.
What you do
- Enrol devices in remote wipe
Evidence to keep
- Endpoint inventory
- Endpoint security configuration reports
DCSDatacenter Security (15 control objectives)Physical security of facilities.4 controls
- DCS-03
Secure areas are defined and protected by policy.
What you do
- Zone facilities and control entry
- DCS-07
Access points to secure areas are controlled.
What you do
- Use badges and visitor logs
- DCS-10
Surveillance covers secure areas.
What you do
- Retain footage per policy
- DCS-13
Environmental systems such as power and cooling are monitored and maintained.
What you do
- Test generators and cooling
Evidence to keep
- Physical access logs
- Equipment disposal records
- Facility audit reports
Secure build and operateApplications, change, infrastructure and vulnerabilities.4 domains · 19 controls
AISApplication and Interface Security (7 control objectives)Secure development and deployment.4 controls
- AIS-04
Applications are designed and developed securely.
What you do
- Follow a secure coding standard
- AIS-05
Automated application security testing is part of the pipeline.
What you do
- Run static and dynamic scans
- AIS-06
Deployment is automated and secured.
What you do
- Use pipeline approvals
- AIS-07
Application vulnerabilities are remediated promptly.
What you do
- Set fix timeframes by severity
Evidence to keep
- Secure development standard
- Test and scan reports
CCCChange Control and Configuration Management (9 control objectives)Approved, tested change.5 controls
- CCC-01
Change management policies exist covering all assets.
What you do
- Write a change policy
- CCC-02
Changes follow quality testing before release.
What you do
- Test in a non-production environment
- CCC-04
Unauthorised changes are prevented.
What you do
- Restrict production deployment rights
- CCC-06
Baselines are defined for change.
What you do
- Maintain hardened baselines
- CCC-07
Deviation from baseline is detected.
What you do
- Monitor configuration drift
Evidence to keep
- Change tickets
- Configuration baselines
IVSInfrastructure and Virtualisation Security (9 control objectives)Hardening, segregation and network defence.5 controls
- IVS-03
Network security controls separate and monitor traffic.
What you do
- Apply firewalls and segmentation
- IVS-04
Operating systems are hardened to baselines.
What you do
- Apply benchmarks
- IVS-05
Production and non-production are separated.
What you do
- Use separate environments
- IVS-06
Tenants and environments are segmented.
What you do
- Isolate customer workloads
- IVS-09
Network defences detect and block attacks.
What you do
- Deploy intrusion detection
Evidence to keep
- Hardening standards
- Network diagrams
TVMThreat and Vulnerability Management (10 control objectives)Find and fix weaknesses.5 controls
- TVM-02
Malware protection policy and tools are in place.
What you do
- Deploy and update anti-malware
- TVM-03
Vulnerability remediation follows a schedule.
What you do
- Define timeframes by severity
- TVM-06
Penetration testing is performed by independent parties.
What you do
- Test annually and after major change
- TVM-07
Vulnerabilities are identified regularly.
What you do
- Scan continuously
- TVM-08
Vulnerabilities are prioritised by risk.
What you do
- Use risk scoring
Evidence to keep
- Scan reports
- Penetration test reports
- Remediation metrics
Detect, respond and recoverMonitoring, incidents and continuity.3 domains · 14 controls
LOGLogging and Monitoring (13 control objectives)Collect, protect and review logs.5 controls
- LOG-01
Logging and monitoring policies exist.
What you do
- Document what is logged
- LOG-03
Security events are monitored and alerts raised.
What you do
- Use a central log system
- LOG-05
Alerts are reviewed and responded to.
What you do
- Triage in defined timeframes
- LOG-06
Clocks are synchronised.
What you do
- Use trusted time sources
- LOG-09
Logs are protected from change.
What you do
- Use write-once storage
Evidence to keep
- Logging standard
- SIEM alert records
SEFSecurity Incident Management, E-Discovery and Cloud Forensics (8 control objectives)Handle incidents and notify customers.4 controls
- SEF-03
Incident response plans are defined and communicated.
What you do
- Keep a tested plan
- SEF-04
Incident response plans are tested.
What you do
- Run annual exercises
- SEF-06
Events are triaged.
What you do
- Define severity levels
- SEF-07
Breaches are notified to affected parties per law and contract.
What you do
- Pre-draft templates and timelines
Evidence to keep
- Incident response plan
- Incident records
- Breach notification procedure
BCRBusiness Continuity Management and Operational Resilience (11 control objectives)Plan, back up and test recovery.5 controls
- BCR-02
Risk assessment and impact analysis are performed.
What you do
- Set recovery targets
- BCR-04
Business continuity plans are established.
What you do
- Document plans for critical services
- BCR-06
Plans are exercised.
What you do
- Test at least yearly
- BCR-08
Backups are made, protected and tested.
What you do
- Test restores regularly
- BCR-09
Disaster response plans exist.
What you do
- Maintain a disaster recovery plan
Evidence to keep
- Business continuity plan
- Backup and restore test results
- Exercise reports
Nothing matches. Clear the search or pick another domain group.
Outcomes and implementation examples are from CSA Cloud Controls Matrix v4 and the STAR Registry (Cloud Security Alliance), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Download the matrix
And the questionnaire.
- 2
Self-assess
Answer honestly.
- 3
Fix gaps
Prioritise.
- 4
Submit to the registry
Level 1 is free.
- 5
Choose a higher level
When customers ask.
How Optimus CyberX helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus CyberX |
|---|---|
| Level 1: self-assessment | Questionnaire workspace |
| Level 2: third-party audit | Evidence pack |
| Continuous monitoring | Control monitoring |
| Cloud Controls Matrix | Controls library |
| Mapping to standards | Control mapping |
| Registry listing | Listing checklist |
Free CSA STAR readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Questionnaire starter
- Control mapping sheet
- Evidence tracker
- Registry checklist
Share or cite this page
Writing about CSA STAR? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/csa-star/">CSA STAR explained in plain English - Optimus CyberX</a>Common questions
Is STAR a certificate?
Level 1 is a self-assessment. Higher levels involve third-party audit.
Does it cost to list?
The Level 1 self-assessment is complimentary. Optional extras, such as the Valid-AI-ted check, carry a fee.
Who looks at the registry?
Customers and partners comparing cloud providers. A public listing saves you from filling in many separate questionnaires.
How does it relate to ISO 27001?
Higher levels build on ISO 27001. Level 2 pairs the Cloud Controls Matrix with an independent audit, such as ISO 27001.
Related frameworks
See how ready you are for CSA STAR
Answer questions across every area. We email you a report showing where you comply and where you do not.