CSA STAR Certification: ISO 27001 plus CCM explained

What CSA STAR Certification adds to ISO 27001 for cloud providers

Cloud providers often find that customers want cloud-specific assurance on top of ISO 27001. CSA STAR Certification is a STAR Level 2 third-party assessment that combines ISO/IEC 27001 requirements with the CSA Cloud Controls Matrix (CCM). It is performed by CSA-approved assessment firms and, following normal ISO/IEC 27001 practice, expires after three years unless it is updated. The ISO 27001 audit still forms the core of the work. The CCM adds a cloud-focused set of control areas that the assessor tests alongside the ISMS, so the effort depends on three things: how mature the existing ISMS already is, how many CCM areas fall inside the service scope, and which level the provider has chosen. A provider that already holds ISO 27001 with a clean scope will usually face less rework than one that is building the management system and the cloud mapping at the same time. Confirm the CCM version and the scope statement with the approved assessment firm before you start, because both change the evidence list.

Responsibilities stay separate. The organization owns its controls, decides how each CCM area is met, and maintains the evidence. An implementation partner can prepare systems, configuration baselines and evidence packs, but it does not decide the result. Only the approved assessor issues the STAR Certification, and that certification is what customers and their third-party risk teams will check. Before you buy outside help, ask the partner to show how its work stays independent of the assessment firm, and ask the assessment firm to confirm what it will accept as evidence for each area.

Which STAR path fits which buyer situation

This table compares the four STAR paths (Level 1 self-assessment, Level 2 STAR Certification, Level 2 STAR Attestation and C-STAR) by issuer, effort, validity and fit. Read each row against your customers' questionnaire demands and whether you already hold ISO 27001, SOC 2 or GB/T 22080-2008. Confirm assessor fees and effort with any firm before committing.

Path	Who issues it and what it costs in effort	Validity and when it fits
Level 1 self-assessment	Your organization completes the CAIQ v4 questionnaire, based on the CCM, at no CSA fee. Effort is internal, mainly evidence gathering and answer accuracy.	Listed in the public STAR Registry and updated annually. Fits early-stage cloud providers who need a posted security posture before a formal audit.
Level 2 STAR Certification	A CSA-approved assessment firm performs a third-party audit against ISO/IEC 27001 combined with the CCM. Confirm assessor fees and audit days in writing.	Expires after three years unless updated, following normal ISO 27001 practice. Fits cloud providers already running or building an ISMS that want independent proof for enterprise buyers.
Level 2 STAR Attestation	A CSA-approved assessment firm issues the attestation based on a SOC 2 examination. Confirm scope and fees with the assessor before work starts.	Expires after one year. Fits providers that already report on SOC 2 and whose customers expect annual assurance rather than a three-year certificate.
C-STAR	A CSA-approved assessment firm assesses against GB/T 22080-2008. Confirm the assessor's approval and the Chinese-language reporting needs before engaging.	Fits providers serving customers who require GB/T 22080-2008 specifically, typically in the China market. Check whether your customers accept the other STAR paths instead.
Combining paths	Level 2 is the level that bundles a STAR certification or attestation with the others. CSA suggests Level 2 for medium to high risk environments that already hold ISO 27001, SOC 2, GB/T 22080-2008 or GDPR compliance.	Ask each assessor which evidence can be reused across paths, since overlapping controls may reduce duplicate work.

Who owns controls, who prepares evidence and who certifies

The cloud provider owns the information security management system (ISMS) and every decision that goes with it. It sets the scope of the service, decides which risks it accepts, approves the policies, and is accountable for whether each control works in daily operation. For STAR Certification the provider also owns the mapping between its ISO/IEC 27001 controls and the Cloud Controls Matrix (CCM), because the statement it makes to customers is its own. No outside party can accept those decisions on its behalf.

ISMS ownership: Leadership sets the scope, approves the risk treatment decisions and signs off the Statement of Applicability.
CCM mapping: The provider decides how each CCM control is met by its ISO 27001 controls and keeps that mapping current when services change.
Control operation: Staff run access reviews, change approvals, monitoring and incident handling, and produce the records that show it.
Management review: Leaders review performance and nonconformities and decide on corrective actions.
Customer statements: The provider decides what its public STAR Registry entry says and answers for it.

Before engaging anyone, confirm internally who holds each of these decisions and who will sign the management representations an assessor will request.

How the combined ISO 27001 and CCM assessment runs

The sequence moves from defining the cloud service and its ISMS boundary, through mapping the Cloud Controls Matrix onto those controls, to an independent assessor's audit, closure of findings and a public registry listing that is renewed on a three-year cycle. Each phase produces a document or record the next phase depends on. Timing depends on scope, so confirm it with the assessor before planning.

Define the cloud service and ISMS scope
The organization decides which cloud service, product line, hosting locations and supporting teams fall inside the assessment, and records the boundary in the ISMS scope statement. The organization owns this decision, and an implementation partner can help draft it. The step is complete when leadership has approved the scope in writing and the assessor has confirmed that the scope is one it can assess. Ask the assessor early whether the proposed boundary matches the services customers actually buy, because a mismatch found late is expensive to correct.
Map the CCM to the ISMS controls
Teams take the Cloud Controls Matrix (CCM) and the CAIQ questions that come with it and map each cloud-specific control to the Annex A controls and clause requirements already in the ISMS, or to new controls where a gap exists. This mapping shows where one control can satisfy both standards and where a separate procedure or technical measure is needed. The output is a traceable matrix linking each CCM control to a named owner, a control implementation and an evidence source. The step is done when the matrix has been reviewed by the control owners and the assessor has agreed the approach.
Implement and run the controls
Control owners put the mapped controls into operation for long enough to produce a real operating history, covering access reviews, change records, vulnerability management, logging, supplier checks and incident handling. Platform teams configure the self-hosted systems that generate this evidence, and the organization remains accountable for every control. The step is complete when each control has run, and its records show who performed the activity, when, and what the result was. Gaps found during this phase should be closed here, not during the audit.
Prepare the evidence pack
The team collects and indexes the documents, logs, tickets, screenshots and configuration exports that show each control operating, and cross-references them to both the ISO 27001 requirements and the CCM controls. A pre-assessment or internal audit is a useful check that the pack answers the questions an assessor will ask. The output is an evidence index that lets an assessor find any control's proof without help. The step is done when internal reviewers can trace each CCM control from its statement to its evidence.
Complete the independent assessor audit
A CSA-approved assessment firm examines the ISMS against ISO/IEC 27001 and the CCM controls in scope, through document review, interviews and sampling of operating records. The assessor, not the organization or any implementation partner, decides the conclusions. Ask the assessor to confirm the audit days, sampling approach and remote or on-site arrangements before work begins. The output is a draft report that lists conformity and any nonconformities or observations, and the step closes when the assessor issues its final findings.
Close findings and obtain the certificate
The organization analyzes each nonconformity, records root cause and corrective action, and provides evidence that the fix works. The assessor verifies the corrections before the certification decision is made. Where the outcome is positive, the certification body or assessor issues the STAR Certification record, which is also an ISO 27001 certificate for the scope. The step is complete when the corrective actions are accepted and the certificate or assessor's confirmation is issued in the organization's name.
Publish the STAR listing and maintain the cycle
The organization publishes its STAR result in the public STAR Registry, so customers can review its security posture without sending repeated questionnaires. STAR Certification expires after three years unless updated, and the ISO 27001 cycle requires at least one audit in every calendar year, so surveillance activity continues throughout the period. Teams should track control evidence continuously so that the next assessment starts from a current record. The step is complete when the listing is live and a renewal plan with named owners is approved.

What makes a STAR Certification more costly or slower

A STAR Level 2 assessment is an ISO 27001 audit with the Cloud Controls Matrix layered on top, so most of its cost comes from how much cloud estate is in scope and how well the evidence is already produced. The cards below cover the drivers that move the price and calendar, and what to check before requesting a quote.

Cloud services in scope

Every service that stores, processes or transmits customer data, or that supports those services, is a candidate for the scope statement. Each additional service adds controls to test, configurations to sample and logs to produce. Before asking for a quote, list the services in production and mark which ones the customer-facing product depends on. A narrower, well-defined boundary usually costs less to assess than a broad one that has to be defended line by line. Confirm with the assessment firm how it counts services and sampling.

Locations and data centers

The number of regions, data centers, offices and hosting sites in scope multiplies the evidence an assessor may need to see, from physical access records to backup configurations per location. Organizations that run multiple regions should decide early whether all of them belong in the scope or whether one region is the defined boundary. Ask the assessor how multi-site sampling works and what documentation it expects per site.

Third-party and subservice dependencies

Infrastructure providers, managed databases, payment processors and other subservice organizations raise the question of how their controls are covered. Organizations need each provider's own assurance, such as its ISO 27001 certificate or SOC report, plus a clear split of responsibilities. Gaps here often surface late, when the assessor asks for evidence the organization has never requested from a supplier. Build the supplier evidence register before the audit window opens.

Evidence maturity

An assessor tests whether controls operate over time, not only whether a policy exists. Teams with access reviews, change tickets, vulnerability scan records and incident logs that are generated automatically and stored in one place spend far less time on evidence requests than teams that rebuild records at audit time. Test the evidence pack internally by picking a sample control and asking whether its proof can be produced within a day. Open-source GRC and logging tools can help, but confirm they export records in a form the assessor accepts.

Existing ISO 27001 status

An organization that already holds a valid ISO 27001 certificate has a mature ISMS, and the STAR assessment mainly adds the CCM mapping and cloud-specific tests. An organization starting from no certificate must build the ISMS, run internal audits and complete a management review before the certification audit can proceed. Check the certificate's scope, validity date and certification body, because a scope that excludes the cloud platform will need to be extended. Confirm with the certification body which cycle stage applies.

Choosing Level 1 or Level 2

Level 1 is a free self-assessment using the CAIQ v4, listed in the public STAR Registry and updated annually. Level 2 is a third-party assessment that carries a three-year validity under normal ISO 27001 practice. CSA suggests Level 2 for organizations in medium to high risk environments that already hold ISO 27001, SOC 2, GB/T 22080-2008 or GDPR compliance. Customers that accept a self-assessment may not require Level 2, so ask prospective customers which level their procurement process needs before committing to the more expensive path.

What must be in place before the assessment

A CSA STAR Certification assessment tests the ISO/IEC 27001 management system and the CCM answers together, so the same evidence has to hold for both. Check each item below against your live environment before you book an assessor, because gaps found during the assessment carry a cost in time and in the certificate's credibility.

Working ISMS and Statement of Applicability

The ISMS must be operating, not just documented. Confirm that each of the 93 Annex A controls has a justified include or exclude decision in the Statement of Applicability, that the reasons for exclusions are recorded, and that the owner of each control can show it running over recent months. Check the SoA against the cloud service scope so no in-scope service is left out.

Current risk assessment and treatment plan

The assessor will expect a risk assessment that reflects the cloud platform as it runs today, including new regions, new managed services and new subprocessors. Confirm that risk owners have accepted residual risks in writing and that the treatment plan links each risk to the controls in the SoA. A risk register last reviewed before a major architecture change will draw questions.

CCM-mapped evidence for each control

Each Cloud Controls Matrix control your STAR assessment covers needs a named piece of evidence that shows it operating. Map every CCM control to the ISO 27001 Annex A control it supports and to a source system, such as an access review export, a change ticket or a backup restore log. Check that no CCM domain relies only on a policy document.

Defined cloud service scope

Write down the cloud services in scope, the infrastructure and tenant boundaries they run on, the data types they process and the locations involved. The scope statement should match the ISMS scope, the CCM answers and the public registry entry. Confirm that any customer-facing service omitted from the scope is excluded on purpose and that the exclusion is justified.

Current CAIQ answer set

The Consensus Assessments Initiative Questionnaire (CAIQ v4) is built on the CCM, and its answers must match what the assessor sees in the system. Review each answer against current configuration, check that no answer describes a control that was retired or changed, and confirm that the person signing the answers can explain each one. Outdated answers are a common reason an assessment slips.

Evidence register with retention and ownership

Build one register that lists each piece of evidence, its CCM and Annex A reference, the system that produces it, the owner, the collection frequency and the storage location. Confirm that evidence from the last audit period is retrievable without asking an engineer to rerun reports by hand. Gaps in this register are often what turns a clean assessment into a list of nonconformities.

How STAR for AI builds on ISO 42001

CSA's STAR for AI program applies the same two-level logic as CSA STAR to AI systems, but it is built on the AI Controls Matrix (AICM) and the AI-CAIQ rather than the Cloud Controls Matrix. Level 1 is an AI-CAIQ self-assessment, which the organization completes itself and can publish. Level 2 is the step that matters for buyers who want more than a self-declaration: since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2. The two parts are separate. The AI-CAIQ must be validated, and the ISO 42001 certificate must be issued by an accredited certification body, so a provider needs both before it can claim Level 2.

ISO/IEC 42001 is a separate management system certification with its own scope, audit and certification body. Holding an ISO 27001 certificate, or a CSA STAR Certification built on it, does not count toward ISO 42001, and an ISO 42001 audit does not replace the AI-CAIQ validation. Organizations planning both should map their AI management system scope against the AI systems they actually provide, because the ISO 42001 certificate defines what Level 2 covers. Ask the certification body how it handles overlapping clauses with an existing ISMS, and whether its audit plan will cover AI system development, deployment and use in the same visit.

Before committing budget, confirm the current requirements directly with CSA, since the STAR for AI program and its validation steps may change. Ask CSA which validation process applies to the AI-CAIQ, whether a specific accreditation or recognition is needed for the body issuing the ISO 42001 certificate, and how Level 2 is recorded in the public STAR Registry. Then ask your certification body to confirm in writing that its ISO 42001 accreditation scope covers your AI services. Treat these answers as the basis for timeline and cost planning, not the general descriptions in this page.

How to choose an approved assessor and an implementation partner

Two different parties touch a STAR Certification engagement: the assessment firm that issues the report and the implementation partner that prepares systems and evidence. The cards below cover what to verify about each before you sign, and how to keep their roles separate.

Confirm the assessment firm is CSA-approved

A STAR Level 2 assessment must be performed by an assessment firm approved by the Cloud Security Alliance. Ask the firm to show its current approval status and the STAR Level 2 scope it covers, and check that status yourself with CSA rather than relying on a logo in a proposal. An assessment by an unapproved firm will not produce a STAR Certification that customers can rely on. Ask whether the firm also holds the accreditation its ISO 27001 work requires.

Check accreditation of the ISO 27001 body

The ISO/IEC 27001 part of STAR Certification is a certification decision, so the body issuing it should be an accredited ISMS certification body. Confirm that its accreditation covers ISO/IEC 27001 and the ISO/IEC 27006-1 requirements that now apply to all clients. Search for the certificate in the IAF CertSearch database, which ISO still points to for checking accredited certificates, and confirm the certificate's scope matches your cloud services.

Keep the implementer and assessor separate

The partner that builds your controls should not also issue your certificate. An implementation partner prepares systems, policies and evidence, while the assessor tests them and decides. If one firm does both, ask how it will avoid reviewing its own work and whether the assessor will still be independent during surveillance audits. Put the separation of roles into the written scope so that neither party can later claim the other owns a control.

Verify cloud and multi-tenant experience

STAR Level 2 tests your ISO 27001 management system against the Cloud Controls Matrix, which covers tenant isolation, shared responsibility, cloud logging and provider dependencies. Ask the assessor and the implementer for examples of cloud service audits they have run, the infrastructure they have worked on, and how they test shared responsibility with your hosting provider. Ask for named auditors and implementers so that you can check their experience directly.

Ask for written scope before signing

Most engagements should start with a written scope that names deliverables, systems in scope, exclusions, responsibilities and timelines. Ask the implementer which controls it will prepare and which evidence it will hand over, and ask the assessor what it will test and which sampling it will use. Confirm how changes to scope are priced and approved, and what happens if the assessment finds nonconformities that need additional work.

Ask who owns the controls

The organization owns its controls, policies and risk decisions, and it must be able to explain them to customers and assessors without the implementer present. Ask the implementer to name the internal owner for each control area, and ask how knowledge is transferred at the end of the engagement. A partner that offers to run the controls indefinitely should explain what the organization keeps if the contract ends.

Questions buyers ask about CSA STAR Certification

Is CSA STAR required in addition to ISO 27001?

No, CSA STAR is not a replacement for ISO 27001 and it is not automatically required on top of it. STAR Certification is built on ISO/IEC 27001 requirements and adds the CSA Cloud Controls Matrix (CCM), so the ISMS audit is the foundation. CSA suggests Level 2 for organizations in medium to high risk environments that already hold ISO 27001, SOC 2, GB/T 22080-2008 or GDPR compliance. Whether your customers ask for it depends on their contracts and their third-party risk process. Ask each customer which artifact satisfies their requirement before you commit to the extra CCM work, since an ISO 27001 certificate alone may already meet the request.

How long does a CSA STAR certification stay valid?

A STAR Certification follows normal ISO/IEC 27001 practice and expires after three years unless it is updated. The three-year cycle comes from ISO/IEC 17021-1, which requires at least one audit in every calendar year of the cycle, either surveillance or recertification. A STAR Attestation based on SOC 2 is different and expires after one year. What renews the certificate is the ongoing surveillance audit program and, at the end of the cycle, a recertification audit by a CSA-approved assessment firm. Confirm the exact audit calendar and fees with the assessment firm before you plan the budget.

Is a STAR Level 1 self-assessment enough for a customer request?

It depends on what the customer asked for. STAR Level 1 is a free self-assessment in which you complete the Consensus Assessments Initiative Questionnaire (CAIQ v4), based on the CCM, and list it in the public STAR Registry. It shows your posture and can reduce repeated questionnaires, but it is not a third-party assessment. Customers that require independent verification will expect Level 2, which involves an assessment by a CSA-approved firm. Ask the customer whether a self-declared CAIQ is acceptable, and check whether they accept an ISO 27001 certificate in its place.

How much internal effort does CSA STAR certification take?

Most of the effort falls on internal staff because the evidence has to come from your own systems and people. The ISMS work is the largest share: scope, risk assessment, policies and the Statement of Applicability must already exist for ISO 27001. On top of that, you must map your controls to the CCM, answer the CAIQ accurately, and keep records that show each control operates over time. Expect ongoing time from security, engineering and operations owners for the audit and for the questionnaire follow-ups. Ask any partner or assessor to estimate effort against your written scope rather than relying on general rules of thumb.

Can an implementation partner complete CSA STAR certification alone?

No. An implementation partner can prepare systems, controls and evidence, but it cannot issue the certificate. STAR Certification is performed by CSA-approved assessment firms, and the certificate is issued through that independent process. DeployOpen, for example, prepares and documents controls and evidence for compliance assessments but does not issue audit reports, attestations or certifications. Your organization owns its controls and its decisions, so you must still run the program, approve the scope and respond to findings. Check that the assessment firm is approved by CSA before you contract with them.

How do customers use the public STAR Registry?

Customers use the public STAR Registry to review a provider's security and compliance posture without sending their own questionnaire first. CSA says the registry helps organizations show customers their posture, which can reduce the need for repeated customer questionnaires. Level 1 entries are self-assessments listed by the provider, and Level 2 entries reflect third-party assessments. Procurement and security teams typically check the registry during vendor onboarding, then request the full CAIQ or certificate evidence when they need detail. Keep your entry current, because CSA states that Level 1 registry entries are updated annually.

What is STAR for AI and how does it relate to ISO 42001?

STAR for AI is CSA's program for AI systems. It builds on the AI Controls Matrix (AICM), the AI-CAIQ and ISO/IEC 42001. Level 1 is an AI-CAIQ self-assessment. Since 20 November 2025, a validated AI-CAIQ combined with ISO/IEC 42001 certification achieves STAR for AI Level 2. If your product uses AI and your customers ask about it, you should evaluate the AI track alongside the cloud track. Confirm the current requirements with CSA before you scope the work, because the program has its own assessment rules.

Where to check the rules and the registry

Before you rely on a CSA STAR claim, check the current rules at the source. The CSA STAR certification page sets out the STAR levels, what a Level 2 assessment covers and which assessment firms are approved to perform it. Read it alongside the ISO/IEC 27001:2022 standard itself, which defines the ISMS requirements that the STAR Certification audit tests, and the CSA STAR certification and attestation levels page is the natural starting point for confirming scope and terminology.

The ISMS half of the assessment follows the certification body rules, so read ISO/IEC 17021-1:2015 to understand what an accredited certification body must do: the three-year cycle, the audit each calendar year and the expectations for audit planning and decisions. Ask any assessment firm to show which accreditation covers the ISO 27001 portion of its work and how it applies ISO/IEC 27006-1:2024, which accredited bodies were required to apply to all clients by 31 March 2026. Confirm these points with the firm, not only with the CSA website.

Before you accept a certificate from a supplier, check it in the registry. Use IAF CertSearch to confirm that an ISO/IEC 27001 certificate was issued by an accredited body, its scope, its validity dates and whether it has been withdrawn. For the CSA STAR listing, search the public STAR Registry and confirm the expiry date, since a Level 2 certification runs three years unless it is updated. A registry entry that cannot be matched to the supplier's legal entity and certified scope should be treated as unverified until the supplier explains the gap.

How DeployOpen prepares cloud systems and evidence for STAR

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, so the systems and evidence behind your CSA STAR Certification: ISO 27001 plus the Cloud Controls Matrix are ready for review. An independent auditor approved for STAR performs the assessment and issues the certification, while DeployOpen prepares the controls and records that support it.

How we scope

Each engagement starts with a written scope that names the services, environments and CCM domains covered.
We confirm with you which STAR level you are pursuing and which assessment firm you plan to use.
Scope, deliverables and timelines are agreed in writing before any work begins, and quotes follow from that scope.

How we build

We implement and harden the self-hosted platforms and infrastructure that run your ISMS and cloud controls.
We map each in-scope control to the platform component, configuration or procedure that operates it.
We run security testing against applications, APIs and cloud infrastructure so gaps are found before the assessor arrives.

How we hand over

You receive documentation of configurations, control owners, procedures and the evidence each control produces.
Evidence is organized so your team and the assessor can trace each CCM control to its supporting records.
Your staff are trained to operate the controls, so the evidence keeps flowing after the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as retainers for the period between assessments.
Before each surveillance or reassessment, we can review the evidence set and close gaps you identify.
Ask us to confirm in writing which assessment and certification tasks remain with you and your independent assessor.