CSA STAR: Cloud Controls Matrix, CAIQ and STAR Levels Explained
CSA STAR is the Cloud Security Alliance's assurance program for cloud services. It is built on the Cloud Controls Matrix, a cloud-specific control framework of 17 domains, and the Consensus Assessments Initiative Questionnaire. Providers can publish a free self-assessment (Level 1) in the public STAR Registry or obtain independent assurance (Level 2) by combining the matrix with ISO/IEC 27001 certification or a SOC 2 attestation. The matrix moved to version 4.1 in 2026, and STAR for AI extends the program to AI services.
CSA STAR is the Cloud Security Alliance's program for making cloud security transparent. At its centre is the Cloud Controls Matrix (CCM), a control framework written specifically for cloud computing, and a public registry where providers publish how they meet it. A provider can start with a free self-assessment that customers can download from the registry, then add independent assurance by combining the matrix with an ISO/IEC 27001 certification or a SOC 2 attestation.
For SaaS companies, STAR is a practical way to answer the cloud security questionnaires that arrive with every enterprise deal. The matrix moved to version 4.1 in January 2026, with a published transition timeline, and the program now has a companion for AI services. This guide explains the matrix, the questionnaire, the STAR levels, how to prepare, and how STAR fits with ISO/IEC 27017, SOC 2 and FedRAMP.
What is CSA STAR?
The Cloud Security Alliance is a not-for-profit organisation that develops cloud security best practices. Its STAR program (Security, Trust, Assurance and Risk) has three building blocks:
- Cloud Controls Matrix (CCM): a cybersecurity control framework for cloud computing, organised in 17 domains, with each control mapped to other standards and with guidance on responsibilities between provider and customer.
- Consensus Assessments Initiative Questionnaire (CAIQ): a set of yes or no questions, with comments, that a provider answers to show how it implements the CCM controls. Version 4.1 has 283 questions.
- STAR Registry: a free public registry where providers publish their self-assessments and third-party assessment results, so customers can find them without asking.
The 17 CCM domains
| Domain | Domain |
|---|---|
| Audit and Assurance (A&A) | Identity and Access Management (IAM) |
| Application and Interface Security (AIS) | Interoperability and Portability (IPY) |
| Business Continuity Management and Operational Resilience (BCR) | Infrastructure and Virtualization Security (IVS) |
| Change Control and Configuration Management (CCC) | Logging and Monitoring (LOG) |
| Cryptography, Encryption and Key Management (CEK) | Security Incident Management, E-Discovery and Cloud Forensics (SEF) |
| Datacenter Security (DCS) | Supply Chain Management, Transparency and Accountability (STA) |
| Data Security and Privacy Lifecycle Management (DSP) | Threat and Vulnerability Management (TVM) |
| Governance, Risk and Compliance (GRC) | Universal Endpoint Management (UEM) |
| Human Resources (HRS) |
A distinctive feature of the CCM is the shared security responsibility model built into it: for each control, the matrix indicates how responsibility is typically shared between cloud service provider and customer for different service models, which helps both sides avoid gaps.
History and why CSA STAR was introduced
The Cloud Security Alliance was formed in 2008 and 2009 as cloud adoption grew and buyers struggled to assess providers. The first CCM and CAIQ were published to give buyers and providers a common language. The STAR Registry launched in 2011 to make provider answers public, and Level 2 third-party options were added through partnerships with certification bodies and the AICPA. CCM v4, released in 2021, restructured the domains for modern cloud and DevOps practices, and CCM v4.1 followed in January 2026, adding and consolidating controls (for example data centre metrics and threat analysis and modelling) and updating mappings.
The aim has always been transparency and efficiency: one public, structured description of a provider's controls instead of hundreds of different questionnaires.
Who uses CSA STAR?
- Cloud infrastructure and platform providers, which publish STAR entries for their services.
- SaaS companies of all sizes, many of which start with a Level 1 self-assessment.
- Enterprise buyers and procurement teams, which use the registry and CAIQ to assess providers.
- Public sector cloud schemes in some countries, which reference CSA STAR or the CCM.
It is global and voluntary.
STAR levels
| Level | Option | What it involves |
|---|---|---|
| Level 1 | STAR Self-Assessment | Provider completes the CAIQ (or documents conformity to the CCM) and publishes it in the STAR Registry. Free, updated regularly. |
| Level 2 | STAR Certification | An accredited certification body audits against ISO/IEC 27001 plus the CCM, including a maturity assessment of the CCM controls. |
| Level 2 | STAR Attestation | A CPA firm performs a SOC 2 engagement that includes the CCM criteria as additional subject matter. |
| Level 2 | C-STAR | An assessment for the Chinese market based on national standards together with the CCM. |
CSA has described further continuous-monitoring options over time; check the STAR program pages for the levels currently offered.
The v4.1 transition
CSA published a transition timeline for CCM v4.1: from early 2026 submissions could use v4.1, and Level 2 assessments move fully to v4.1 by December 2027, with v4.0 withdrawn after that. Check CSA's timeline for the exact dates for each level before planning your next submission.
STAR for AI
CSA extended the program to AI services with the AI Controls Matrix (AICM), whose version 1.1 was released in June 2026 with control objectives across 18 domains, and an AI-CAIQ for self-assessment. CSA describes STAR for AI Level 2 as building on ISO/IEC 42001 together with the AI Controls Matrix. Check CSA for the current availability of each level.
How to prepare a STAR submission step by step
- Define the service you are assessing and its boundaries, including your own cloud providers.
- Download the current CCM and CAIQ and read the implementation guidelines and shared responsibility guidance.
- Answer honestly. A "no" with a clear explanation is better than an unsupported "yes"; customers and auditors will test claims.
- Reference evidence: policies, certifications, architecture descriptions and customer-facing documentation.
- Clarify shared responsibilities for each control, especially where customers must configure something.
- Fix gaps before publication where feasible, starting with IAM, CEK, LOG and TVM controls.
- Publish Level 1 in the STAR Registry and keep it current.
- Plan Level 2 by adding the CCM to your ISO/IEC 27001 audit scope (STAR Certification) or to your SOC 2 engagement (STAR Attestation).
Writing good CAIQ answers
The CAIQ is read by security reviewers who see many of them, and vague answers invite follow-up questions. Strong answers are specific, point to evidence and state who is responsible. Some illustrations of the difference:
| Domain | Weak answer | Stronger answer |
|---|---|---|
| IAM | "Yes, we use strong authentication." | "Yes. Staff access to production requires SSO with phishing-resistant MFA through our identity provider. Customers can enforce MFA and SAML SSO for their users; configuring this is the customer's responsibility." |
| CEK | "Data is encrypted." | "Yes. Customer data is encrypted at rest with AES-256 using keys in a managed key service, rotated annually, with access restricted to the platform service role. TLS 1.2 or higher is enforced in transit." |
| LOG | "We keep logs." | "Yes. Application, authentication and infrastructure logs are centralised, protected from modification and retained for 12 months. Customers can export audit logs of activity in their tenant." |
| DSP | "We delete data when asked." | "Yes. Customers can export and delete data through the admin console and API. On termination, production data is deleted within 30 days and backups expire within a further 35 days, as stated in our DPA." |
| IPY | "Data can be exported." | "Yes. Full exports are available in JSON and CSV through the console and a documented API, without additional fees." |
The figures in these examples are illustrations; use your real settings. Whatever you write, make sure your contracts and product say the same thing.
CCM areas SaaS teams often overlook
- Interoperability and portability (IPY): documented export formats and APIs, which customers need for exit planning and which regulations such as the EU Data Act increasingly expect.
- Security incident management, e-discovery and cloud forensics (SEF): how you preserve evidence in a multi-tenant system and support customers' legal or forensic requests without exposing other tenants.
- Supply chain transparency (STA): an inventory of your own cloud and SaaS suppliers, their assurance reports, and how responsibilities flow through the chain.
- Universal endpoint management (UEM): controls on staff laptops and mobile devices that can reach production or customer data.
- Threat analysis and modelling, added as an explicit control in v4.1, which many teams do informally but never document.
Documentation you will need
- Completed CAIQ for the current version.
- Information security policies covering the CCM domains.
- Architecture and data flow descriptions for the service.
- Shared responsibility documentation for customers.
- Evidence supporting answers: certificates, audit reports, procedures and records.
- For Level 2: the ISO/IEC 27001 ISMS documentation or SOC 2 system description, extended to cover the CCM.
Audits and assurance
Level 1 entries are not independently verified, which customers understand; CSA expects providers to keep them accurate and updated. Level 2 STAR Certification is performed by certification bodies authorised by CSA, as part of an accredited ISO/IEC 27001 audit, and includes a maturity rating of how well the CCM controls are managed. STAR Attestation is performed by CPA firms authorised by CSA as part of a SOC 2 examination. Level 2 results are listed in the STAR Registry.
Timeline and cost considerations
A Level 1 self-assessment costs staff time but no fees, and is a sensible first step for any SaaS provider. Level 2 adds audit time to an ISO/IEC 27001 or SOC 2 engagement you may already have, plus effort on CCM controls that your existing scope does not cover, typically interoperability and portability, cloud forensics, and some supply chain transparency items. Plan around CSA's v4.1 transition so that you do not complete work against a version that is about to be withdrawn.
Benefits and the risk of not participating
A public STAR entry reduces repetitive questionnaires, shows transparency, and gives customers a structured view of your controls and shared responsibilities. Level 2 adds credible independent assurance without a completely separate audit. There is no penalty for not participating, but buyers who use the registry may favour providers they can assess quickly.
Common mistakes and challenges for IT companies
- Over-claiming in the CAIQ. Answers become part of your sales record and can be checked.
- Stale registry entries that no longer match the service.
- Ignoring shared responsibility, leaving customers unaware of what they must configure.
- Answering for the infrastructure provider's controls as if they were yours, without explaining inheritance.
- Using an outdated CCM version late in the transition.
Best practices, tools and technologies
- Maintain the CAIQ alongside your control register so updates flow from one source.
- Use CCM mappings to reuse ISO/IEC 27001, SOC 2 and NIST evidence.
- Publish a trust page linking your STAR entry, certifications and shared responsibility guide.
- Prioritise product controls customers ask about most: SSO and MFA, encryption and key management, audit logs, tenant isolation, data export and deletion.
- For AI services, start with the AI-CAIQ and align with ISO/IEC 42001.
We build the product-side controls behind many CAIQ answers in SaaS products.
How CSA STAR relates to other frameworks
| Framework | Relationship |
|---|---|
| ISO/IEC 27001 | STAR Certification combines an ISO/IEC 27001 audit with the CCM. |
| SOC 2 | STAR Attestation combines a SOC 2 engagement with the CCM. |
| ISO/IEC 27017 and ISO/IEC 27018 | Cloud security and cloud privacy codes of practice mapped in the CCM. |
| BSI C5 | German cloud criteria; the CCM provides mappings to many such schemes. |
| FedRAMP | US federal program; separate requirements, though CCM maps to NIST SP 800-53. |
| ISO/IEC 42001 | Basis, with the AI Controls Matrix, for STAR for AI Level 2. |
Real-world implementation examples
The STAR Registry lists entries from large cloud providers and thousands of SaaS services, including major CRM, collaboration and support platforms. Browsing it shows the range of maturity, from detailed Level 2 entries to brief Level 1 self-assessments.
An illustrative case for a growing SaaS company: its sales team receives a different security questionnaire with every enterprise deal. It completes the CAIQ, fixes three gaps (MFA enforcement for admins, customer-facing audit logs and documented key management), publishes a Level 1 entry, and links it from its trust page. Many prospects accept the CAIQ in place of their own questionnaire, and the company later adds the CCM to its ISO/IEC 27001 audit for Level 2.
Next steps
- Download CCM v4.1 and the CAIQ.
- Complete a draft self-assessment and identify gaps.
- Fix the gaps customers ask about most.
- Publish a Level 1 entry and keep it current.
- Plan Level 2 within your existing ISO/IEC 27001 or SOC 2 cycle.
Frequently asked questions
Is CSA STAR a certification?
Level 1 is a self-assessment. Level 2 STAR Certification is an ISO/IEC 27001-based certification including the CCM; STAR Attestation is a SOC 2-based attestation including the CCM.
What is the Cloud Controls Matrix?
A cloud-specific control framework from the Cloud Security Alliance, organised in 17 domains, with mappings to other standards and shared responsibility guidance.
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire, a structured set of questions providers answer to show how they implement the CCM. Version 4.1 has 283 questions.
What is the latest CCM version?
CCM v4.1, released in January 2026, with a transition from v4.0 published by CSA.
Is CSA STAR free?
Publishing a Level 1 self-assessment in the registry is free. Level 2 involves audit fees from certification bodies or CPA firms.
Do customers accept the CAIQ instead of their questionnaire?
Many do, especially when combined with a certification or SOC 2 report, though some still require their own forms.
What is STAR for AI?
CSA's extension of the program to AI services, using the AI Controls Matrix and an AI-CAIQ, with a Level 2 option building on ISO/IEC 42001.
How does CSA STAR relate to ISO 27017?
Both address cloud security; the CCM maps to ISO/IEC 27017, and STAR Certification builds on the same ISO/IEC 27001 management system.
How often should the self-assessment be updated?
Whenever the service or controls change significantly, and at least on the cycle CSA expects for registry entries.
Does a STAR entry replace a penetration test?
No. The CAIQ describes controls; it does not test them. Customers often still ask for a recent penetration test summary and a certification or SOC 2 report.
Can a small SaaS company use CSA STAR?
Yes. Level 1 is designed to be accessible and is a good way for small providers to structure and publish their security posture.
Official sources
- CSA STAR program (Cloud Security Alliance)
- Cloud Controls Matrix v4.1 transition timeline (Cloud Security Alliance)
- CSA STAR v4.1 explained (Cloud Security Alliance)
- STAR for AI (Cloud Security Alliance)
- AI Controls Matrix v1.1 (Cloud Security Alliance)
Review history
Last reviewed Oct 30, 2026. Next scheduled review Apr 30, 2027, or sooner if CSA updates the Cloud Controls Matrix, the STAR levels or the transition timeline.
- : First published, covering CCM v4.1 and STAR for AI.
This guide explains the official requirements in plain language. It is not legal advice and does not tell you whether your organisation is compliant. Confirm with qualified counsel, your auditor or an accredited certification body.