What are the CSA STAR levels?

Level 1 is a self assessment: you answer the questionnaire based on the control matrix and publish it in the public registry, with no audit. Level 2 is the independent third party assessment, which can be issued as a certification based on ISO 27001 or as an attestation based on SOC 2. There is also a continuous option, for organisations that want to show ongoing monitoring rather than an annual snapshot.

Where does ISO 27017 fit in?

ISO 27017 provides cloud specific security guidance and builds on ISO 27001, drawing a clear line between what the provider is responsible for and what the customer is. It covers much of what the control matrix asks for, so it works well as an intermediate step: you move beyond plain 27001, pick up the cloud vocabulary and reach STAR with less effort.

Do I need STAR if I already have ISO 27001?

It depends on who buys from you. If your customers procure cloud services and send vendor questionnaires, STAR removes much of that friction and puts your company in a public registry they consult. If your sales cycle does not involve that kind of due diligence, ISO 27001 on its own usually does the job.

How long does STAR Level 2 take?

The timeline is set by ISO 27001, because that is what carries the rest. Companies already certified can widen the scope to the control matrix at the next audit cycle. Starting from scratch means implementing and certifying the management system first, then adding the cloud layer. Running both in parallel from the start is what shortens the path most.

Cloud security

CSA STAR vs ISO 27001

Plenty of people treat these as alternative routes, and they are not. ISO 27001 is the foundation: the international standard that certifies your security management. CSA STAR is the cloud layer built on top of it, with controls specific to providers and their customers, and the result appears in a public registry any buyer can check. Foundation first, cloud layer second.

Explore governance and compliance Go to the comparison

In short

ISO 27001 certifies information security management across the company, within the scope you define.
CSA STAR is the Cloud Security Alliance assurance programme, built on the Cloud Controls Matrix.
STAR has levels: the first is a published self assessment; the second is an external audit and requires ISO 27001 alongside it.
STAR results sit in a public registry, so the programme doubles as a commercial shop window.

Side by side

Management foundation against cloud layer

What to compare	ISO/IEC 27001	CSA STAR
What it is	International standard certifying information security management.	Cloud assurance programme based on the Cloud Security Alliance control matrix.
Who publishes it	ISO and IEC, the international standards bodies.	Cloud Security Alliance, a nonprofit focused on cloud.
Reach	All information security within the declared scope.	Cloud specifically, with 197 control objectives across 17 domains.
How you get it	Certification audit by an accredited body.	Level 1 by self assessment; Level 2 by external audit alongside ISO 27001.
Depends on the other	No. It stands alone.	Yes, at Level 2: ISO 27001 must be in place or running in parallel.
Where it shows up	On the certificate you show customers.	In the public STAR registry, which anyone can search.
Cost of entry	Paid standard and paid audit.	Level 1 carries no audit cost; Level 2 adds audit work to the ISO 27001 one.
Who it suits	Any company that needs to prove security.	Anyone offering cloud services or selling to buyers who demand cloud assurance.

Compared with Annex A of ISO 27001, much of the Cloud Controls Matrix is equivalent or more detailed, and a smaller slice is cloud specific. That slice is what STAR adds.

The foundation everything sits on

ISO/IEC 27001

It certifies that your company manages information security in an organised, verifiable way: defined scope, assessed risk, controls chosen with justification and improvement tracked over time. It applies to any sector and it is the credential that opens the most doors worldwide. If you are only going to invest in one thing, start here, not least because STAR Level 2 depends on it.

Recognised in any market and sector
Scope you define, not cloud specific
Certificate valid for three years
Prerequisite for CSA STAR Level 2

The cloud specific layer

CSA STAR

The Cloud Security Alliance maintains the Cloud Controls Matrix, with 197 control objectives across 17 domains, designed to answer what changes when the service runs in the cloud: who is responsible for what between provider and customer, how tenants stay separated, what happens to the data on the way out. Level 1 is a self assessment published in the registry. Level 2 is an external audit carried out alongside the ISO 27001 one. There is also a continuous option, for organisations that want to show ongoing monitoring.

197 control objectives across 17 cloud domains
Level 1 by self assessment, published in the registry
Level 2 by external audit alongside ISO 27001
Public registry that works as a commercial shop window

How they fit together

The right order saves time and money

STAR Level 2 is not a separate audit: the auditor widens the scope of the ISO 27001 audit to cover the cloud controls in the matrix. Companies that understand this early get both done in a single pass, with the same body and the same evidence cycle. Along the way there is also ISO 27017, a set of cloud security guidance that builds on 27001 and covers much of what the matrix asks for. Many organisations use 27017 as a comfortable stepping stone before taking on STAR.

ISO 27001 first, since it is the mandatory basis for Level 2
ISO 27017 is a comfortable intermediate step for cloud
STAR Level 2 comes out of the same audit, with a wider scope

Which case is yours

Where to start

You hold no security certification at all yet

Start with ISO 27001

It is the basis for everything and the most accepted credential. Without it, STAR Level 2 never leaves the ground.

You need to show up quickly as a trustworthy cloud vendor

Publish STAR Level 1

The self assessment enters the public registry with no audit and already answers much of the customer questionnaire.

Your customer demands audited cloud assurance

ISO 27001 plus STAR Level 2

The complete route, and cheaper when both audits run together rather than separately.

Numbers that matter

197

control objectives in the Cloud Controls Matrix

cloud security domains

Level 2

only issued with ISO 27001 in place or in parallel

How DM11 solves it

ISO 27001, ISO 27017 and CSA STAR in the order that saves an audit

We build the ISO 27001 foundation with cloud already in mind, use ISO 27017 as the bridge and take you to the STAR registry without rewriting evidence. One plan, one set of documents serving all three fronts.

One audit instead of two: wider scope in the same cycle
Your company appears in the public STAR registry, where buyers look
We translate the control matrix to your actual environment, never a copied template
Customer security questionnaires start coming with answers already written

Talk about cloud certification

Common questions

What people ask before deciding

Answers checked against the Cloud Security Alliance STAR programme and control matrix, and ISO/IEC 27001:2022.

It does not replace it, and at Level 2 it depends on it. STAR Level 2 certification is granted on top of a management system already certified to ISO 27001, with the audit scope widened to the cloud controls in the matrix. Companies that try to skip ISO 27001 tend to discover this after spending the time.

Prove cloud security without paying for two audits

A short conversation shows the right order for your case and how much fits into a single cycle.

Talk to a specialist Explore governance and compliance

CSA STAR vs ISO 27001

What to compare

ISO/IEC 27001

CSA STAR

What it is

International standard certifying information security management.

Cloud assurance programme based on the Cloud Security Alliance control matrix.

Who publishes it

ISO and IEC, the international standards bodies.

Cloud Security Alliance, a nonprofit focused on cloud.

Reach

All information security within the declared scope.

Cloud specifically, with 197 control objectives across 17 domains.

How you get it

Certification audit by an accredited body.

Level 1 by self assessment; Level 2 by external audit alongside ISO 27001.

Depends on the other

No. It stands alone.

Yes, at Level 2: ISO 27001 must be in place or running in parallel.

Where it shows up

On the certificate you show customers.

In the public STAR registry, which anyone can search.

Cost of entry

Paid standard and paid audit.

Level 1 carries no audit cost; Level 2 adds audit work to the ISO 27001 one.

Who it suits

Any company that needs to prove security.

Anyone offering cloud services or selling to buyers who demand cloud assurance.

ISO/IEC 27001

Recognised in any market and sector

Scope you define, not cloud specific

Certificate valid for three years

Prerequisite for CSA STAR Level 2

CSA STAR

197 control objectives across 17 cloud domains

Level 1 by self assessment, published in the registry

Level 2 by external audit alongside ISO 27001

Public registry that works as a commercial shop window

The right order saves time and money

ISO 27001 first, since it is the mandatory basis for Level 2

ISO 27017 is a comfortable intermediate step for cloud

STAR Level 2 comes out of the same audit, with a wider scope

ISO 27001, ISO 27017 and CSA STAR in the order that saves an audit

One audit instead of two: wider scope in the same cycle

Your company appears in the public STAR registry, where buyers look

We translate the control matrix to your actual environment, never a copied template

Customer security questionnaires start coming with answers already written