CSA STAR Guide (2026): Levels, CCM v4.1, CAIQ and STAR for AI

Who it applies to

STAR is voluntary. It's aimed at cloud service providers: IaaS, PaaS and SaaS vendors, and increasingly AI providers. CSA positions Level 1 for organizations "operating in a low-risk environment" that want a cost-effective way to show transparency. Level 2 suits organizations in "a medium to high risk environment" that already hold or follow ISO 27001, SOC 2, GB/T 22080-2008 or GDPR (CSA STAR). Cloud customers use the registry to review providers before buying.

The Cloud Controls Matrix: key requirements

The CCM is "a cybersecurity control framework for cloud computing" that also says which party in the cloud supply chain should implement each control (CSA CCM). Its 17 domains are:

The CCM download includes:

• implementation guidelines
• auditing guidelines, which extend the CCAK guide
• mappings to ISO, NIST, PCI DSS and other standards
• machine-readable versions in JSON/YAML and OSCAL

You need a license to customize the CCM or use it commercially. You don't need one for internal use.

Certification and attestation process

Level 1: self-assessment

1. Download the submission version of the STAR Level 1 Security Questionnaire (CAIQ v4). You can't submit the combined CCM+CAIQ reference spreadsheet (CSA STAR).
2. Answer the yes/no questions for your service and add explanations.
3. Submit to the registry. Submissions are publicly visible and should be updated annually.
4. If you want the Valid-AI-ted badge, the AI scoring service gives "near-instant feedback" for a $595 USD fee, which includes up to 10 scoring attempts. CSA Corporate Members use it at no cost.
5. Small and early-stage companies can start with CCM Lite + CAIQ Lite.

Level 2: third-party audit

• STAR Certification is an independent audit combining ISO/IEC 27001 requirements with the CCM. Certificates "follow normal ISO/IEC 27001 protocol and expire after three years unless updated".
• STAR Attestation comes from a CSA–AICPA collaboration. CPAs perform SOC 2 engagements using the Trust Services Criteria plus the CCM, and attestation listings "expire after one year unless updated".
• C-STAR is for the Greater China market. It combines GB/T 22080-2008 and the CCM with 29 controls from GB/T 22239-2008 and GB/Z 28828-2012, and is valid for three years.

CSA directs you to its Code of Practice for Implementing STAR Level 2 and its list of approved assessment firms. Level 2 has fees, which are reduced for CSA Corporate Members, but they aren't published (CSA STAR).

STAR for AI

STAR for AI applies STAR to AI risk using the AI Controls Matrix (AICM), the AI-CAIQ and ISO/IEC 42001.

• Level 1: submit an AI-CAIQ self-assessment.
• Level 2: as of November 20, 2025, a Valid-AI-ted AI-CAIQ combined with ISO/IEC 42001 certification earns STAR for AI Level 2 (CSA STAR).

Timeline and costs

Level 1 takes as long as it takes you to complete the CAIQ. The standard submission is free, and Valid-AI-ted costs $595. Level 2 follows your ISO 27001 certification cycle or SOC 2 reporting period, because the CCM is assessed as part of those audits.

Penalties

STAR carries no legal penalties. If listings aren't renewed, they lapse: one year for attestations, three years for certifications, and annual updates are expected for self-assessments. Out-of-date answers that are publicly visible can hurt your credibility with customers.

Mapping to related frameworks

• ISO/IEC 27001: the basis of STAR Certification. CCM mappings help extend your Statement of Applicability.
• SOC 2: the basis of STAR Attestation, with the CCM added as extra criteria.
• ISO/IEC 42001: required for STAR for AI Level 2.
• NIST, PCI DSS and GDPR: covered by the official CCM mappings (CSA CCM).

Readiness checklist

1. Decide your target: Level 1, Level 1 Valid-AI-ted, STAR Certification, STAR Attestation, or STAR for AI.
2. Download CCM v4.1 and the correct submission CAIQ.
3. Map your existing ISO or SOC controls to the CCM's 197 objectives using the official mappings.
4. Write down shared-responsibility decisions for each CCM control.
5. Fill gaps, especially in the cloud-specific domains (IPY, IVS, DSP, STA, UEM).
6. Complete and review the CAIQ with security, legal and product owners.
7. Submit to the registry, or run it through Valid-AI-ted.
8. For Level 2, choose an approved assessment firm and add the CCM to your ISO or SOC audit scope.
9. Schedule the annual CAIQ refresh and track when each listing expires.

Common pitfalls

• Submitting the reference spreadsheet instead of the submission CAIQ.
• Saying "yes" without evidence. Customers and auditors will check.
• Letting a listing lapse, which then looks stale on the public registry.
• Ignoring shared responsibility. Customers need to know what they're responsible for.
• Treating Level 1 as audited assurance.

How AssureCore helps

AssureCore's Controls Register and Cross-framework Mapping let you link CCM-aligned controls to existing ISO 27001 and SOC 2 evidence. Evidence Management, with expiry alerts, keeps CAIQ answers backed by current evidence, and Audit Reports export to PDF or CSV for auditors.

Frequently asked questions

Official references

• Cloud Security Alliance – STAR program
• Cloud Security Alliance – Cloud Controls Matrix

Related frameworks

• ISO 27001 guide
• SOC 2 guide
• NIST CSF guide
• NIST 800-171 guide