CSA STAR Assessment
- Choose the right Level 2 route for your market
- Map CCM controls to your cloud services
- Publish independent assurance on the STAR Registry
Listed by the Cloud Security Alliance as a certified STAR auditor.
Who Needs a CSA STAR Assessment?
CSA STAR Level 2 suits cloud providers that need independent evidence of their cloud security controls:
SaaS and Cloud Application Providers
IaaS and PaaS Providers
Managed and Hosted Service Providers
Providers Answering Enterprise Security Reviews
Providers Already Holding ISO 27001 or SOC 2
Providers Moving from STAR Level 1 to Level 2
Our CSA STAR Assessment Approach
Auditor-led delivery from route selection through Level 2 audit, reporting and STAR Registry listing.
Deliverables You Can Expect
Audit outputs mapped to your chosen STAR Level 2 route and the Cloud Controls Matrix.
STAR Route & Scope Summary
CCM Applicability Matrix
Documentation Review Findings
STAR Certification Audit Report
STAR Attestation Report (SOC 2 + CCM)
STAR Registry Listing Support
Benefits of a CSA STAR Level 2 Assessment
Faster Security Reviews
A public STAR Registry listing helps customers answer cloud security questions sooner.
Cloud-Specific Assurance
Covers cloud controls in the CCM that general frameworks do not address directly.
Reuse Existing Audits
Builds on ISO/IEC 27001 or SOC 2 work instead of starting a separate program.
Independent Validation
Third-party audit carries more weight with buyers than a Level 1 self-assessment.
Clear Shared Responsibility
Documents which cloud controls you own and which your customers or providers own.
Stronger Enterprise Positioning
Supports procurement in regulated and security-conscious customer segments.
Why Cloud Providers Choose QRC
Independent cloud assurance from a CSA-listed STAR auditor.
Listed by CSA for both STAR Certification and STAR Attestation audits.
Accredited ISO/IEC 27001 certification body for the STAR Certification route.
Experience across ISO/IEC 27001, SOC 2, PCI DSS and cloud security frameworks.
Clear scoping, evidence review, findings tracking and registry-focused execution.
Supporting Services
Services that strengthen your cloud assurance program alongside CSA STAR.
ISO/IEC 27001 Certification
Accredited ISMS certification that forms the base for the STAR Certification route.
Learn More
SOC 2 Examination
Trust Services Criteria examination that forms the base for the STAR Attestation route.
Learn More
Penetration Testing
Test cloud applications, APIs and infrastructure for exploitable weaknesses before audit.
Learn MoreReal-World CSA STAR Assessment Outcomes
How cloud providers completed STAR Level 2 audits and published independent assurance.
CSA STAR Resource Center
Learning resources to help you choose a STAR route and prepare for a Level 2 audit.
How can SaaS companies benefit from ISO 27001?
Information security concerns are unavoidably sparked by the use of cloud environments.
Frequently Asked Questions
CSA STAR (Security, Trust, Assurance and Risk) is the Cloud Security Alliance's assurance program for cloud services. It is built on the Cloud Controls Matrix (CCM) and publishes results on the public STAR Registry.
Level 1 is a self-assessment: the provider completes the CAIQ and submits it to the STAR Registry. Level 2 requires a third-party audit by a certified STAR auditor, resulting in STAR Certification or STAR Attestation.
STAR Certification combines an ISO/IEC 27001 certification audit with the CCM. STAR Attestation combines a SOC 2 examination with the CCM. Your customers, markets and existing audits usually decide which route fits.
Yes. QRC Assurance and Solutions Inc. appears on CSA's list of certified STAR auditors for both STAR Certification and STAR Attestation. CSA publishes the resulting listing on the STAR Registry.
STAR Level 2 is performed together with an ISO/IEC 27001 certification or a SOC 2 examination, so one of these is part of the engagement. Organizations that already hold one can extend it to include the CCM.
Ready to Start Your CSA STAR Assessment?
Confirm your Level 2 route, clear scope and a structured path to the STAR Registry.