CSA STAR
Independent CSA STAR attestation with SOC 2, or certification with ISO/IEC 27001, tested against the Cloud Controls Matrix by a firm that runs both engagements together.
Understanding the CSA STAR program
The STAR program from the Cloud Security Alliance (CSA) (opens in a new tab) gives cloud service providers a clear path to demonstrate their security and build customer trust. Third-party assessments start at Level 2. Linford & Company LLP is a CSA STAR Attestation Approved Assessment Firm.
Level 1
Publicly disclose your alignment with the Cloud Controls Matrix through the Consensus Assessments Initiative Questionnaire (CAIQ), maintained by the Cloud Security Alliance.
Level 2
An independent auditor verifies your controls against the Cloud Controls Matrix, through either STAR Attestation or STAR Certification.
Two routes to Level 2
Level 2 can be achieved through STAR Attestation or STAR Certification. Both test against the Cloud Controls Matrix; your existing assurance program decides which one fits.
SOC 2 + Cloud Controls Matrix
Performed in conjunction with a SOC 2 examination by a licensed CPA firm that follows the AICPA Trust Services Criteria and attestation standards.
Verify on CSA (opens in a new tab)
About our SOC 2 auditsISO/IEC 27001 + Cloud Controls Matrix
Conducted with an ISO/IEC 27001 certification, so both the ISO requirements and CSA’s additional cloud-specific controls are met. It must be issued by a body accredited to audit ISO/IEC 27001.
Verify on CSA (opens in a new tab)
About our ISO 27001 certificationApplicable cloud service models
CSA STAR applies to all major cloud service models. It matters most for providers in highly regulated industries and those handling sensitive data such as PII, financial, or healthcare information.
Infrastructure as a Service
Compute, storage, and networking in the cloud.
Platform as a Service
Development and runtime environments in the cloud.
Software as a Service
Applications delivered over the internet.
Our process
We coordinate the Level 2 assessment with your SOC 2 or ISO/IEC 27001 engagement, so the work runs together instead of twice.
What shapes your quote
Confirm scope, the route to Level 2, and the timeline alongside your SOC 2 or ISO/IEC 27001 engagement.
Review your scope, policies, and Level 1 CAIQ results against the Cloud Controls Matrix.
Perform independent testing of your controls against the Cloud Controls Matrix.
Issue your SOC 2 with STAR Attestation, or your ISO/IEC 27001 certification with STAR Certification.
Your CSA STAR listing appears in the CSA STAR Registry.
Why Linford & Company
Linford & Company LLP is a CSA STAR Attestation Approved Assessment Firm. Our assessments are performed by professionals holding the CCSK, alongside other relevant audit designations.
A licensed CPA firm for SOC 2 and an accredited ISO/IEC 27001 certification body, so either route to Level 2 stays with one team.
A high level of partner involvement on our assessments. We can use our own tools or your chosen GRC platform.
Our team
Partner
CPA, CIA, CISA, CCSK, CMMC Lead Certified Assessor (Lead CCA), ISO 42001 Lead Auditor, ISO 27001 Lead Auditor
Leads our CSA STAR assessments. Partner since 2020 with a career that began at Ernst & Young in 1989, specializing in SOC, HIPAA, ISO, CMMC, and CSA STAR audits.
Director
CISSP, CCSFP, CCSK, CHQP, ISO 27001 Lead Auditor
More than three decades in system administration and information security across government and industry. Performs CSA STAR, HITRUST, ISO/IEC 27001, and SOC 2 audits.
Frequently asked questions
Still have questions? Ask a partner
CSA STAR (Security, Trust, Assurance, and Risk) is an assurance program developed by the Cloud Security Alliance. It gives cloud service providers a way to demonstrate their security capabilities and compliance with industry standards, based on the CSA Cloud Controls Matrix.
The CCM is the Cloud Security Alliance's framework of cloud-specific security controls. STAR Level 2 assessments, whether attestation or certification, test controls against the CCM.
Both are CSA STAR Level 2 third-party assessments against the Cloud Controls Matrix. STAR Attestation is performed with a SOC 2 examination by a licensed CPA firm. STAR Certification is performed with an ISO/IEC 27001 certification by a firm accredited to audit ISO/IEC 27001. Linford & Company can deliver either.
Yes. The Level 2 assessment is performed concurrently or consecutively with a SOC 2 examination (for STAR Attestation) or an ISO/IEC 27001 certification (for STAR Certification). We coordinate the work so the engagements run together.
Fees depend on the complexity of the cloud platform being assessed and are usually combined with ISO/IEC 27001 or SOC 2 work. We provide an upfront quote before the engagement begins. CSA also charges a pass-through fee per assessment, based on criteria CSA determines.
IaaS, PaaS, and SaaS providers are the primary candidates, especially cloud service providers in highly regulated industries or those handling sensitive data such as PII, financial data, or healthcare information.
From the blog
Ready to get started?
Talk with a partner about your CSA STAR goals and the right route for your platform.
