CSA STAR (Security, Trust, Assurance and Risk) registry
A public registry where cloud providers publish a self-assessment against the Cloud Controls Matrix (Level 1) or a third-party audit result (Level 2).
- 3requirementsin our own words
- 0editions none dated yet
- 0places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is voluntary in the 30 places assessed. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 30 places | Applies | Voluntary In force | None stated No law in this country requires it; customers, lenders or tenders decide. | Not stated |
What it asks for
3 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Choose the cloud service to register and the registry level. | Registration scope Record, checked by document review | Compliance manager | Once Governance, a system or service |
| Publish a self-assessment answer set (Level 1) and update it annually. | Published questionnaire Record, checked by document review | Compliance manager | Every year Disclosure, a system or service |
| For Level 2, hold a third-party certification or attestation and register it. | Certificate or report Certificate, checked by document review | Quality | Each certification cycle Management system, a system or service |
Stages, levels and report types
What each one is, how long it is valid, and the claim you may make once you hold it.
| Stage or level | Report or award | Period and validity | What you may say |
|---|---|---|---|
| Level 1 self-assessment | self-assessment (published questionnaire) | not applicableupdated annually | Say: STAR Level 1 self-assessment published on the CSA registry. It is not an audit. |
| Level 2 third-party audit | certification or attestation | depends on the underlying auditfollows the underlying audit | Say: STAR Level 2 certification or attestation, naming the underlying audit. |
About the programme
- Scheme owner
- Cloud Security Alliance
- Assessed by
- Several parties
- Scope
- cloud service
- Levels
- Level 1 self-assessment; Level 2 third-party certification or attestation
- Validity
- Level 1 self-assessments are updated annually; Level 2 follows the underlying audit.
- Accreditation route
- CSA-certified STAR auditors for Level 2
- Who asks for it
- Enterprise and colocation customers, Wholesale and hyperscale customers
- Where it is used
- global
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.