CSA STAR Level 2

Overview

CSA STAR Level 2 requires independent third-party auditing of cloud security controls against the Cloud Controls Matrix (CCM). This certification goes beyond the Level 1 self-assessment to provide auditor-verified assurance. The audit can be conducted as a standalone CCM assessment or integrated with ISO 27001 or SOC 2 examinations. CodeMiners' STAR Level 2 certification provides the highest level of cloud security assurance available through the CSA program.

Governing Body

Cloud Security Alliance (CSA)

Scope of Certification

Same scope as CSA STAR Level 1, with the addition of independent auditor verification. Covers all CCM domains: application and interface security, audit assurance, business continuity, change control, data security, encryption, governance, human resources, identity and access management, infrastructure and virtualization, interoperability and portability, mobile security, security incident management, supply chain, and threat and vulnerability management.

Audit and Assessment Process

An accredited third-party auditor conducts an assessment of the organization's cloud security controls against the CCM. The audit can be combined with ISO 27001 Stage 2 or SOC 2 Type II examinations to reduce audit burden. Results are published on the CSA STAR Registry.

Key Requirements

1. All Level 1 CAIQ requirements
2. Independent third-party verification of CCM controls
3. Audit conducted by a CSA-accredited assessment organization
4. Public registration of audit results

Compliance Entitlements

• Third-party audited cloud security controls
• Verified against the Cloud Controls Matrix (CCM)
• Higher assurance than Level 1 self-assessment
• Required by security-conscious enterprise cloud buyers

Client Benefits

• Provides independently verified cloud security assurance
• Eliminates reliance on self-reported security claims
• Comparable across cloud providers using a standardized framework

Related Certifications