Run the CSA STAR program with CCM v4

What is CSA STAR?

CSA STAR — Security, Trust, Assurance and Risk — is the Cloud Security Alliance's cloud assurance program. It gives cloud providers a recognized way to document and publish their security posture, and gives cloud customers a public registry to evaluate them. STAR is built on two artifacts: the Cloud Controls Matrix (CCM) and the Consensus Assessment Initiative Questionnaire (CAIQ).

CCM v4 and the CAIQ

The current CCM v4 organizes roughly 197 control objectives across 17 domains of cloud security — identity and access management, data security and privacy, application security, supply-chain management, and more — with the shared-responsibility model built in. The CAIQ is the questionnaire form of the CCM: a standardized set of yes/no questions that maps to each control, designed to replace the endless bespoke security questionnaires that cloud buyers send.

STAR Levels

• Level 1 — Self-Assessment. Complete the CAIQ (or a CCM-based self-assessment) and publish it to the free, public CSA STAR registry.
• Level 2 — Third-Party Assessment. An accredited assessor verifies your controls, often as a STAR Certification (paired with ISO 27001) or STAR Attestation (paired with SOC 2).

How episki helps

episki ships the CCM v4 catalog as living controls, generates consistent CAIQ v4 answers from your real evidence, and cross-maps every CCM control to ISO 27001, SOC 2, and NIST CSF. Reach STAR Level 1 from your existing program, or assemble the Level 2 package without rebuilding a thing.