# CSA STAR: Cloud Security Alliance Security, Trust, Assurance and Risk programme

> Cloud assurance based on the Cloud Controls Matrix, from self-assessment to third-party certification.

URL: https://securei3.com/standards/csa-star/
Category: Attestation & assurance: Attestation / assessment
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)


CSA STAR offers levels from a published self-assessment against the Cloud Controls Matrix (CCM) to third-party STAR Certification (with ISO 27001) and STAR Attestation (with SOC 2). We help cloud providers complete the CAIQ and pursue certification.

## Who it is for

- Cloud and SaaS providers

## Benefits

- A recognised cloud trust signal
- Reuse of ISO 27001 and SOC 2 work

## How Secure iQube helps

1. **Scoping**: Agree the systems, services and criteria in scope, and whether a Type 1 or Type 2 report fits your customers and timeline.
2. **Readiness assessment**: Map existing controls to the criteria, identify gaps and design missing controls with owners and evidence.
3. **Remediation**: Put policies, tooling and processes in place, and rehearse evidence collection so it is routine, not a scramble.
4. **Assessment coordination**: We help you engage the right assessor for your chosen STAR level, prepare the evidence and support you through the assessment and any follow-up actions.
5. **Observation period and report**: For Type 2, we monitor controls through the observation window and help you respond to exceptions before the report is issued.

## Frequently asked questions

### What is the CAIQ?

The Consensus Assessments Initiative Questionnaire lets providers document which CCM controls they implement; publishing it is STAR Level 1.

Related: https://securei3.com/standards/iso-27017/, https://securei3.com/standards/soc-2/, https://securei3.com/standards/iso-27001/

Contact: https://securei3.com/contact/: info@securei3.com