CyphrQ
Menu

CSA CCM and STAR Explained: How Buyers Vet Cloud Providers

The Cloud Security Alliance's CCM is a cloud control framework; STAR is the registry where providers publish proof. Levels, versions and reading an entry.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

The Cloud Controls Matrix (CCM) is a list of cloud security controls from the Cloud Security Alliance (CSA). STAR is the public registry where cloud providers publish evidence against it. STAR has two levels: a self-assessment, and an independent audit. When a provider says "we're on STAR", the useful question is which level, which CCM version, and which services.

What are the CSA Cloud Controls Matrix and STAR, and who publishes them?

The Cloud Security Alliance is a nonprofit dedicated to cloud security best practice. Both the CCM and STAR come from CSA, not from ISO or a government.

  • The CCM is a framework of cloud security controls. CSA's CCM page calls it a de-facto standard for cloud security assurance and compliance, and says it can be used to assess a cloud implementation and to show which party in the cloud supply chain should implement each control. The page gives the current version as 4.1 and describes it as having 17 domains and 197 control objectives.
  • The CAIQ (Consensus Assessments Initiative Questionnaire) is a set of yes/no questions built from the CCM. A provider answers it to describe its controls.
  • STAR (Security, Trust, Assurance and Risk) is the assurance programme and its public registry. CSA's STAR page describes the registry as publicly accessible, documenting the security and privacy controls of cloud offerings. Microsoft's compliance documentation says CSA and the British Standards Institution launched STAR in 2013.

A "meta-framework" is a framework that maps to others. CSA's own CCM v4 page describes the CCM as mapped to leading standards, best practices and regulations. That is why one CCM assessment can serve several buyers.

What does the CCM cover?

The CCM groups its controls into domains. The domain names are the useful part to know, because they match how most security questionnaires are laid out: governance, identity and access, data security, logging, incident management, supply chain, threat and vulnerability management, and more. CSA's v4.1 announcement names several domain codes, including Datacenter Security (DCS), Logging and Monitoring (LOG), Security Incident Management (SEF), Supply Chain Management (STA) and Threat and Vulnerability Management (TVM).

Two features set it apart from a general control catalogue.

  1. It is cloud-specific. Each control is aimed at the cloud setting and shows which actor should implement it, so the shared responsibility between provider and customer is part of the framework, not an afterthought.
  2. It comes with a question set. The CAIQ turns controls into questions a buyer can read and a provider can answer, which is what makes the registry practical for procurement.

I have not reproduced the control text here. CSA says you need a licence to customise the CCM or use it commercially, but not for internal use, so read the current spreadsheet from CSA itself.

Who uses the CCM and STAR, and can you be certified?

Providers publish on STAR. Buyers read it. Auditors use the CCM as a checklist for cloud-specific criteria.

You cannot be "CCM certified" on its own. STAR is the route to an assessment, and it has two levels, per CSA's STAR page:

Level 1 Level 2
What it is Self-assessment using the CAIQ Independent third-party audit
Evidence The provider's own answers A STAR Attestation (built on SOC 2) or STAR Certification (built on ISO/IEC 27001)
Who checks it Nobody external A CPA firm or an accredited certification body
Expiry Updated annually Attestation listings expire after one year; certificates after three

CSA also lists a third Level 2 variant, C-STAR, aimed at the Greater China market. For AI services there is a separate STAR for AI track. CSA says that, as of November 20, 2025, combining a Valid-AI-ted AI-CAIQ with an ISO/IEC 42001 certification earns STAR for AI Level 2.

A Level 1 entry is transparency, not assurance. It is worth having, and it is also easy to publish. A Level 2 entry is the one to weigh in a risk decision, because someone independent checked it.

How do the CCM and STAR relate to ISO and SOC 2?

STAR does not replace the standards you already know. It sits on top of them.

  • SOC 2: STAR Attestation is a joint effort between CSA and the AICPA, giving CPAs guidance for performing SOC 2 engagements that also use CCM criteria. Outside the US, CSA says ISAE 3000 is the equivalent. For SOC 2 itself, see SOC 2 vs ISO 27001.
  • ISO/IEC 27001: STAR Certification leverages the ISO/IEC 27001 management system standard, and its certificates follow normal ISO/IEC 27001 protocol. See ISO/IEC 27001 explained.
  • ISO/IEC 27017 and 27018: Microsoft's page says the CCM maps to ISO 27001, ISO 27017, ISO 27018, NIST SP 800-53, PCI DSS and the AICPA Trust Services Criteria. The ISO side is covered in ISO 27017 vs 27018.

Think of it this way: ISO and SOC 2 tell you a provider's security programme was audited. The CCM adds the cloud-specific lens and a public place to put the result. More standards and frameworks of this kind are on the Frameworks and Bodies subtopic page.

How does a STAR assessment work in practice?

For a provider, the path CSA describes is:

  1. Level 1: complete the standalone STAR Level 1 CAIQ and submit it to the registry. CSA notes that the combined CCM and CAIQ spreadsheet is for reference only and cannot be submitted.
  2. Level 2: CSA's STAR Certification page says a Level 1 submission is required first. An assessor then audits the provider against ISO/IEC 27001 plus the CCM, or against SOC 2 criteria plus the CCM for an Attestation.
  3. Stay current. CSA says STAR Certifications are valid for three years, with annual surveillance audits and recertification in year three. Attestations are valid for one year, then fully re-evaluated.

For a buyer, the path is simpler: search the registry for the provider, read the level and the documents, then compare scope with what you actually use.

In practice: Microsoft's CSA STAR Certification page says the scope of its STAR Certification is aligned to the scope of the ISO/IEC 27001 management system supporting Azure, Dynamics 365, Power Platform and select Microsoft 365 cloud services, and points customers to the STAR registry to download the certificate. The same page says an accredited CSA certification auditor assigns a Management Capability score to each CCM domain. That score is in an internal report, which tells you something useful: the registry shows the outcome, not every working paper.

What changed in CCM version 4.1?

CSA's v4.1 transition announcement says CSA released version 4.1 on January 28, 2026. Compared with v4.0.13, it adds 11 new control specifications, removes one control in Identity and Access Management, and revises existing controls. CAIQ v4.1 has 283 questions. The announcement does not give new totals for controls or domains, so check the current spreadsheet before quoting a number.

The announcement's transition table matters for anyone reading registry entries over the next year or two:

Date What CSA says happens
March 2026 The registry accepts both v4.1 and v4.0 submissions for Levels 1 and 2
December 2027 Level 1 and Level 2 accept only v4.1; surveillance audits and recertifications use CAIQ v4.1
January 2028 v4.0.x is withdrawn and kept only in CSA's archives

In practice, until then you will see a mix of entries. A v4.0 entry is not wrong or out of date yet. It is a prompt to ask when the provider plans to move.

Going deeper: for security and IT teams

Read the entry like an auditor. A registry listing has several fields. Check each one before you rely on it.

  • Level and type. Level 1 self-assessment, Level 2 Attestation (SOC 2 based) or Level 2 Certification (ISO/IEC 27001 based). They are different artefacts with different evidence. A Level 1 entry carries no independent testing.
  • CCM and CAIQ version. Is it v4.0.x or v4.1? Expect both until the dates in CSA's table.
  • Scope. Which services, products and regions? Microsoft's page says its STAR scope follows its ISO/IEC 27001 scope, and it points to the ISO certificate for service-level detail. Do the same for every provider: reconcile the registry scope with the certificate scope and with your own service inventory.
  • Dates. Attestations roll over yearly. Certificates run three years with annual surveillance. An entry with a lapsed date is a finding for your supplier file.
  • Assessor. For Certification, identify the certification body and check its accreditation. CSA's STAR Certification page links requirements for bodies that provide STAR Certification. For Attestation, the firm must be CPAs, and for ISAE 3000 engagements, the equivalent professional body.

Use the CCM as a mapping hub. CSA publishes mappings, including machine-readable JSON and YAML. If your control framework is ISO/IEC 27001 Annex A, NIST SP 800-53 or the AICPA criteria, map your supplier due diligence questions to CCM domains once, and reuse the mapping across suppliers. Where a provider has a Level 2 entry, you can usually skip re-asking questions the audit already covered, and spend your time on scope and customer-side duties.

Do not treat the registry as a substitute for your own controls. CSA's CCM page describes the framework as clarifying shared responsibilities between providers and customers. Take that literally. For each critical service, write down the provider-side controls (evidenced by STAR) and the customer-side ones (your tenant configuration, identity settings, key management, log export, and exit plan). Your own auditor will ask for the second list. The IT general controls explainer covers the sort of evidence they request.

Evidence to collect for a supplier file:

  • A dated copy or screenshot of the registry entry and any downloadable certificate or attestation.
  • The scope statement and a comparison against your service inventory.
  • The CCM and CAIQ version the provider used.
  • For Level 1: the full CAIQ responses, with a named owner for any "no" or partial answer.
  • Your contract clauses covering notification, audit rights, subprocessors and exit.
  • A review date, with a calendar reminder tied to the expiry.

Common nonconformities, described generally. Entries cited without checking scope. A Level 1 self-assessment presented in a questionnaire response as if it were independent assurance. Out-of-date versions never queried. Registry evidence collected once at onboarding and never refreshed. Provider evidence used to claim customer-side controls it cannot cover.

Questions to ask a provider:

  1. Which STAR level and type do you hold, and for which services?
  2. Which CCM and CAIQ version, and when do you move to v4.1?
  3. Who is your assessor or certification body, and what is its accreditation?
  4. How does the registry scope compare with your ISO/IEC 27001 or SOC 2 scope?
  5. Which controls are mine, and where do I find them in your documentation?
  6. For AI services, do you hold a STAR for AI entry or an ISO/IEC 42001 certificate?

Ask your own team: do we record the level, version and expiry of each critical supplier's STAR entry, and does anyone get a reminder before it lapses?

What should you do next about CSA CCM and STAR?

Pick your three most important cloud suppliers and look each one up in the STAR registry this week. Note the level, the CCM version, the scope and the expiry date. Where there is only a Level 1 entry, ask for a SOC 2 report or ISO/IEC 27001 certificate as well. Where there is no entry, ask why, and what they offer instead.

Learn more

Key takeaways

  • The CCM is CSA's cloud security control framework. STAR is the public registry where providers publish assessments against it.
  • STAR has two levels: Level 1 is a self-assessment, Level 2 is independent (Attestation based on SOC 2, Certification based on ISO/IEC 27001).
  • Read the level, CCM version, scope, assessor and expiry. A badge alone tells you nothing.
  • CCM v4.1 was released on January 28, 2026. CSA's table shows only v4.1 accepted from December 2027.
  • A provider's entry covers its half of shared responsibility. Your configuration and access controls are still yours.

Sources