Get audit-ready for CSA STAR
CSA CCM v4 · Cloud Controls Matrix
Cloud Security Alliance Cloud Controls Matrix providing a cybersecurity controls framework specifically designed for cloud computing environments, used for STAR certification.
CSA STARWhat is CSA STAR?
Cloud Security Alliance Cloud Controls Matrix providing a cybersecurity controls framework specifically designed for cloud computing environments, used for STAR certification.
Who it applies to
Cloud service providers evidencing security posture to prospective customers. The public registry makes it unusual: entries are visible to anyone evaluating the provider.
How the standard is organised
Built on the Cloud Controls Matrix, with tiers ranging from a published self-assessment through to third-party assessment — so the STAR level matters as much as the presence of an entry.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
CSA STAR on the Bitkosh platform
The 197 CSA STAR controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- STA-03SSRM Guidance
Give customers guidance and detail on the shared security responsibility model, including the provider's part.
Supply Chain Management, Transparency & Accountability (STA) - IAM-11CSCs Approval for Agreed Privileged Access Roles
Allow customers to approve the privileged access roles that the provider's staff use on their data or systems.
Identity & Access Management (IAM) - IAM-13Uniquely Identifiable Users
Ensure each user or process can be uniquely identified so actions are traceable to them.
Identity & Access Management (IAM) - CEK-06Encryption Change Cost Benefit Analysis
Weigh cost, benefit and risk before changing cryptographic technology, and record the decision.
Cryptography, Encryption & Key Management (CEK) - HRS-04Remote and Home Working Policy and Procedures
Set security requirements for remote, home and off-site working to protect information accessed or processed there.
Human Resources (HRS) - SEF-01Security Incident Management, E-Discovery, and Cloud Forensics Policy and Procedures
Maintain policy and procedures for security incident management, e-discovery and cloud forensics, and review them regularly.
Security Incident Management, E-Discovery & Cloud Forensics (SEF)
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes CSA STAR, and who does it apply to?
How is CSA STAR conformance demonstrated?
How is CSA STAR structured?
Ready to get audit-ready for CSA STAR?
See how the Bitkosh Readiness Platform gets you audit-ready for CSA STAR — and the other 47 ready frameworks — from a single control library.