Cloud assurance / Our approach

CSA STAR Level 2

A practical, scoped engagement for organisations seeking CSA STAR Level 2 support.

How we work

The CSA STAR Level 2 engagement follows the activities below. The scope and outputs are agreed with you before work starts.

01
Confirm cloud service, certification scope and existing ISMS.
02
Map ISO/IEC 27001 controls to applicable CSA CCM controls.
03
Strengthen cloud controls and validate evidence.
04
Conduct an internal readiness review and close gaps.
05
Coordinate the independent audit and support finding closure.

What you can expect

ISO/IEC 27001-to-CCM mapping and cloud control gap assessment
Cloud risk, documentation and evidence trackers
Internal readiness assessment and support for independent certification audit

What we need to get started

Cloud services in scope and existing ISO/IEC 27001 status
Architecture, shared-responsibility information and control records
A project sponsor and nominated certification-body contact

CSA STAR Level 2 / ENGAGEMENT PROCESS

From first discussion to delivery

Typical activities for this service. The agreed scope determines the work and outputs.

01
Confirm cloud service, certification scope and existing ISMS
02
Map ISO/IEC 27001 controls to applicable CSA CCM controls
03
Strengthen cloud controls and validate evidence
04
Conduct an internal readiness review and close gaps
05
Coordinate the independent audit and support finding closure

Proposed scope of services

We will provide comprehensive advisory, implementation, technical validation, and certification-readiness support throughout the CSA STAR journey.

Engagement Phase	Scope of Services
CSA STAR Scoping & Readiness Assessment	Confirm the in-scope cloud service, environment, stakeholders, control boundaries, responsibilities, and overall readiness for the CSA STAR certification journey.
CSA STAR Level 1 Readiness Support	Review applicable self-assessment requirements, identify readiness gaps, and support preparation of the required Level 1 information.
STAR Registry Submission Support	Assist with review, finalization, and submission of the applicable Level 1 documentation to the CSA STAR Registry.
ISO/IEC 27001-to-CSA CCM Mapping	Map relevant ISO/IEC 27001:2022 controls and existing ISMS practices against applicable CSA Cloud Controls Matrix requirements.
CSA CCM Gap Assessment	Assess the current cloud security control environment and identify gaps across governance, technical, operational, documentation, and evidence requirements.
Cloud Security Control Enhancement	Provide practical guidance for implementing, strengthening, or formalizing controls required to address identified CSA CCM gaps.
Documentation & Policy Enhancement	Develop or update applicable policies, procedures, standards, registers, control narratives, and supporting documentation required for certification readiness.
Cloud & Shared Responsibility Review	Review the cloud security responsibilities, relevant configurations, control ownership, and supporting evidence associated with the in-scope cloud environment.
Cloud Risk & Compliance Review	Review cloud-specific risks, treatment actions, control ownership, dependencies, and applicable security or contractual obligations.
Evidence Readiness & Validation	Define evidence requirements and support collection, review, organization, and validation of records demonstrating control implementation and operation.
Internal Readiness Assessment	Conduct a structured pre-certification assessment to evaluate readiness and identify remaining gaps requiring closure.
Corrective Action & Gap Closure Support	Provide guidance and support for remediation of identified control, documentation, evidence, and governance gaps.
Certification Body Coordination	Recommend a suitable certification body and coordinate certification planning, scheduling, documentation requirements, and audit logistics.
CSA STAR Level 2 Audit Support	Support the organization throughout the independent certification audit, including evidence coordination, stakeholder support, and auditor query management.
Post-Audit Non-Conformity Closure	Assist with root-cause analysis, corrective action planning, evidence preparation, and closure of findings raised during the certification audit.

Certification readiness methodology

We will follow a structured, control-focused, and evidence-driven methodology to support the organization through both CSA STAR Level 1 readiness and the ISO-based CSA STAR Level 2 Certification journey.

The approach is designed to build upon the organization’s ongoing ISO/IEC 27001:2022 implementation, align the existing control environment with applicable CSA Cloud Controls Matrix requirements, strengthen cloud-specific security practices, and prepare the organization for an independent certification assessment.

Certification Readiness Lifecycle

Project Launch — Formal project initiation and scope definition
Initial Compliance — Achieving foundational CSA STAR Level 1 compliance
Registry Filing — Assisting with the submission of STAR Level 1 to the registry
Control Alignment — Mapping ISO 27001 controls to CSA CCM requirements
Gap Identification — Assessing current controls against CSA CCM gaps
Control Improvement — Enhancing cloud security controls and documentation
Evidence Gathering — Preparing and validating all required security evidence
Internal Review — Conducting internal assessment to confirm readiness
Gap Remediation — Addressing and closing identified security gaps
Audit Scheduling — Coordinating with the certification body for audit
Audit Assistance — Providing support during the CSA STAR Level 2 audit
Audit Follow-up — Closing any non-conformities identified during the audit

Key deliverables

Deliverable	Description
CSA STAR Readiness Assessment	Current-state review of the organization’s cloud security environment and overall readiness for the CSA STAR certification journey.
Level 1 Readiness & Submission Support	Support for applicable self-assessment requirements, quality review, and preparation for submission to the CSA STAR Registry.
ISO/IEC 27001 - CSA CCM Mapping	Mapping of relevant existing ISO/IEC 27001 controls and ISMS practices against applicable CSA CCM requirements.
CSA CCM Gap Assessment & Action Tracker	Identification of control, documentation, technical, and evidence gaps with prioritized remediation actions and closure tracking.
Cloud Security Documentation	Development or enhancement of applicable policies, procedures, standards, registers, and control documentation required for certification readiness.
Cloud Risk Assessment	Review and documentation of relevant cloud risks, treatment actions, responsibilities, and control alignment.
Shared Responsibility Review	Assessment of applicable responsibilities between the organization and the cloud service provider for the in-scope environment.
Evidence Requirement Tracker	Structured control-wise evidence requirements, ownership, readiness status, and supporting documentation references.
Internal Readiness Assessment Report	Pre-certification review of control implementation, evidence sufficiency, and outstanding certification-readiness gaps.
Corrective Action Tracker	Consolidated tracking of gaps, findings, responsible owners, actions, and closure status.
Certification Audit Support	Coordination and advisory support throughout the independent CSA STAR Level 2 certification assessment.
Post-Audit NC Closure Support	Root-cause, corrective-action, evidence, and closure support for findings raised during the certification audit.

Our engagement approach

Throughout the engagement, we will focus on the following principles:

Control-Based & Risk-Focused - Prioritize cloud-security controls and gaps that materially affect certification readiness and security posture.
Cloud-Specific Implementation - Align recommendations with the realities of the in-scope cloud service and shared-responsibility model.
Evidence-Driven Readiness - Ensure applicable controls are supported by appropriate and auditable evidence rather than documentation alone.
Practical Remediation - Provide actionable recommendations designed to integrate with existing operational and security practices.
Certification Coordination - Maintain close coordination with the selected certification body to facilitate efficient planning, assessment, and issue resolution.

Where an independent certification or attestation applies, the relevant independent body makes its own assessment and decision. Scope and availability are agreed individually.