evident
Book a demo
Glossary

CSA STAR (Security Trust Assurance Risk)

CSA STAR is the Cloud Security Alliance's trust registry and certification program where cloud providers publish security assessments from Level 1 (self-assessment via CAIQ) through Level 3 (third-party continuous auditing).

Nate LeeCo-Founder, CEOPublished

CSA STAR (Security Trust Assurance Risk) is the Cloud Security Alliance's public registry and certification program for cloud providers to demonstrate security posture and controls compliance.

The three-tier program allows providers to progressively certify their controls:

  • Level 1: Free self-assessment using the CAIQ questionnaire
  • Level 2: Third-party audit combining ISO 27001 and ISO 27017 or a SOC 2 Type 2 report
  • Level 3: Continuous auditing and assessment (less common)

Most cloud-native vendors publish a STAR Level 1 entry before investing in Level 2 audit costs.