CSA STAR Level 1
A practical, scoped engagement for organisations seeking CSA STAR Level 1 support.
How we work
The CSA STAR Level 1 engagement follows the activities below. The scope and outputs are agreed with you before work starts.
- 01Scope the cloud service and identify control owners.
- 02Map existing controls to the CCM and CAIQ.
- 03Resolve gaps and collect supporting evidence.
- 04Review and approve the CAIQ responses.
- 05Support the organisation’s Registry submission and updates.
What you can expect
- Cloud service scope and shared responsibility record
- CCM gap and evidence trackers with draft CAIQ responses
- Quality-reviewed submission materials and open-action handover
What we need to get started
- Cloud service description and intended Registry listing
- Architecture, provider responsibilities and current control evidence
- Cloud security, compliance and Registry account owners
From first discussion to delivery
Typical activities for this service. The agreed scope determines the work and outputs.
- 01Scope the cloud service and identify control owners
- 02Map existing controls to the CCM and CAIQ
- 03Resolve gaps and collect supporting evidence
- 04Review and approve the CAIQ responses
- 05Support the organisation’s Registry submission and updates
CSA STAR Level 1: self-assessment and Registry submission
CSA STAR Level 1 is a self-assessment for a cloud service provider. The provider documents how its cloud service addresses the Cloud Controls Matrix (CCM) using the applicable Consensus Assessments Initiative Questionnaire (CAIQ), then submits the questionnaire to the CSA STAR Registry. Level 1 self-assessment is not an independent certification or audit. We support the organisation with preparation, review and submission; the organisation remains responsible for its responses and submission.
Proposed scope of services
We provide structured advisory, assessment, documentation, control-improvement and submission support throughout the Level 1 self-assessment journey, tailored to the cloud service and agreed scope.
| Engagement phase | Scope of services |
|---|---|
| Scoping and launch | Identify the cloud service, service model, environments, boundaries, stakeholders, dependencies and intended Registry listing. Agree deliverables, responsibilities and an evidence request list. |
| CCM and CAIQ planning | Identify the applicable CSA Cloud Controls Matrix and the Registry-submittable CAIQ version. Map questionnaire items to existing control owners, processes and supporting materials. |
| Current-state review | Review existing policies, system documentation, cloud configurations, operational practices and available evidence against the relevant CCM controls and CAIQ questions. |
| Shared responsibility review | Identify responsibilities retained by the organisation, inherited from cloud providers or shared with customers and other parties. Record dependencies and evidence sources. |
| Gap assessment | Identify missing, incomplete or inconsistently evidenced controls, documentation and questionnaire responses. Record gaps, risk considerations, priorities and accountable owners. |
| Control and documentation enhancement | Provide practical guidance to strengthen or formalise cloud controls and update relevant policies, procedures, registers and control narratives where included in the engagement. |
| Evidence collection and validation | Define evidence needs and support collection, organisation and review of records that substantiate CAIQ responses. Track missing information, exceptions and review decisions. |
| CAIQ response preparation | Work with control owners to prepare and review responses and explanations reflecting the actual in-scope service and its implemented controls. Record the basis for responses and relevant limitations. |
| Readiness and quality review | Review questionnaire completeness, consistency with supporting evidence and open actions. Present unresolved items for the organisation's review and approval before submission. |
| STAR Registry submission support | Assist the organisation with preparing its listing and submitting the approved, applicable CAIQ through CSA's current submission process. The organisation controls its account and final submission. |
| Post-submission maintenance | Provide an action and ownership handover for unresolved gaps and future updates. Support review and updating of the listing and CAIQ as agreed when the service or controls change. |
Self-assessment methodology
Our approach is control-focused and evidence-driven. We work with service, security, operations, governance and relevant provider stakeholders to understand how controls operate, review the evidence behind answers, and prepare an accurate self-assessment for the in-scope service.
Existing ISO/IEC 27001 or other control documentation can be used as an input where relevant, but an ISO certificate is not presented as a prerequisite for this Level 1 self-assessment. Any transition to an independent Level 2 assessment is a separate engagement and assurance path.
Key deliverables
| Deliverable | Description |
|---|---|
| Scope and stakeholder record | Agreed cloud service boundaries, service model, stakeholders, responsibilities and dependencies. |
| CCM and CAIQ mapping | Mapping of applicable questionnaire questions and controls to control owners, existing practices and supporting documentation. |
| Gap assessment and action tracker | Identified control, operational, documentation and evidence gaps, with priority, owner, action and status. |
| Shared responsibility review | Documented ownership and dependencies across the organisation, cloud provider, customers and relevant third parties. |
| Evidence requirement tracker | Evidence references, responsible owners, review status and unresolved information needs for applicable responses. |
| Control documentation support | Agreed updates or recommendations for relevant policies, procedures, registers and control descriptions. |
| Draft CAIQ and review record | Prepared questionnaire responses and supporting explanations for control-owner and management review. |
| Submission support and handover | Assistance with submission preparation, confirmation of the organisation's review and approval, and an agreed handover of open actions and maintenance responsibilities. |
Our engagement approach
- Scope-led: Tie answers to the actual cloud service and its boundaries.
- Evidence-driven: Support responses with reviewed records rather than documentation alone.
- Shared responsibility: Make inherited, shared and organisation-owned controls clear.
- Practical remediation: Prioritise actionable improvements with owners and follow-up.
- Accountable submission: The organisation reviews and approves its answers and retains control of its Registry submission.
Reference: CSA STAR submission guidance and CSA Cloud Controls Matrix and CAIQ resources. Confirm the currently accepted questionnaire and submission process at the time of engagement.
CSA STAR Level 1 is a self-assessment, not independent certification. The organisation is responsible for its responses and submission. Scope and availability are agreed individually.