CSA STAR offers levels from a published self-assessment against the Cloud Controls Matrix (CCM) to third-party STAR Certification (with ISO 27001) and STAR Attestation (with SOC 2). We help cloud providers complete the CAIQ and pursue certification.
Who it is for
- Cloud and SaaS providers
What you gain
- A recognised cloud trust signal
- Reuse of ISO 27001 and SOC 2 work
How we get you ready
Scoping
Agree the systems, services and criteria in scope, and whether a Type 1 or Type 2 report fits your customers and timeline.
Readiness assessment
Map existing controls to the criteria, identify gaps and design missing controls with owners and evidence.
Remediation
Put policies, tooling and processes in place, and rehearse evidence collection so it is routine, not a scramble.
Assessment coordination
We help you engage the right assessor for your chosen STAR level, prepare the evidence and support you through the assessment and any follow-up actions.
Observation period and report
For Type 2, we monitor controls through the observation window and help you respond to exceptions before the report is issued.