CSA STAR is the Cloud Security Alliance’s assurance program and public registry for cloud and AI services. Level 1 is a self-assessment submitting a CAIQ against the Cloud Controls Matrix; Level 2 is third-party assurance (ISO/IEC 27001, SOC 2, or C-STAR) combined with a CAIQ. STAR for AI uses the AI Controls Matrix and AI-CAIQ.
CSA STAR
CSA STAR (Security, Trust, Assurance and Risk) publishes cloud and AI providers’ security posture in a public registry. Its building blocks are the Cloud Controls Matrix (CCM), a control framework, and the Consensus Assessments Initiative Questionnaire (CAIQ), in which a provider answers how its service implements each control. Level 1 is a self-assessment; Level 2 is third-party assurance. STAR for AI applies the same structure through the AI Controls Matrix and the AI-CAIQ.
Business layer
STAR is one of the references the API Commons compliance schema is built against: certification, scope, issuing body, period and report access, with a registry listing as evidence. See The Technical Side Translated. The Business Side Did Not.
Industry: compliance
