8 hours ago
Your SaaS platform has a CSA STAR Registry listing, and you’ve filled out a security questionnaire for a potential customer. Is that enough to convince them your cloud service is secure?
Not always. The customer may also want to see the results of a penetration test to check whether someone could break into your systems or access data they shouldn’t. The CAIQ tells customers what security controls you have in place. A penetration test checks whether an attacker could find and exploit weaknesses in your systems.
What Is CSA STAR?
CSA STAR is a cloud-specific assurance programme; ISO/IEC 27001 is a general information security management standard that STAR Certification builds on. The technical backbone of the programme is the Cloud Controls Matrix, or CCM. Think of the CCM as a structured set of security controls for cloud providers, covering areas such as data encryption, access management, and vulnerability management.
The latest version of the Cloud Controls Matrix, CCM v4.1, was released in January 2026. It includes 207 controls across 17 security domains, while the accompanying CAIQ v4.1 contains 283 questions. Level 1 is the Cloud Security Alliance self-assessment option. The provider completes the STAR Level 1 CAIQ and submits it to the public STAR Registry. The CAIQ contains questions about whether specific controls are in place and how they are implemented. Level 2 provides independent assurance through either STAR Certification, which builds on ISO/IEC 27001, or STAR Attestation, which uses the SOC 2 framework alongside the CCM.
The difference is that a CSA STAR assessment documents or evaluates security controls, while a penetration test actively probes a defined system for exploitable weaknesses. The two can support each other, but they do not serve the same purpose.
Source: https://qualysec.com/csa-star-assessment/
Not always. The customer may also want to see the results of a penetration test to check whether someone could break into your systems or access data they shouldn’t. The CAIQ tells customers what security controls you have in place. A penetration test checks whether an attacker could find and exploit weaknesses in your systems.
What Is CSA STAR?
CSA STAR is a cloud-specific assurance programme; ISO/IEC 27001 is a general information security management standard that STAR Certification builds on. The technical backbone of the programme is the Cloud Controls Matrix, or CCM. Think of the CCM as a structured set of security controls for cloud providers, covering areas such as data encryption, access management, and vulnerability management.
The latest version of the Cloud Controls Matrix, CCM v4.1, was released in January 2026. It includes 207 controls across 17 security domains, while the accompanying CAIQ v4.1 contains 283 questions. Level 1 is the Cloud Security Alliance self-assessment option. The provider completes the STAR Level 1 CAIQ and submits it to the public STAR Registry. The CAIQ contains questions about whether specific controls are in place and how they are implemented. Level 2 provides independent assurance through either STAR Certification, which builds on ISO/IEC 27001, or STAR Attestation, which uses the SOC 2 framework alongside the CCM.
The difference is that a CSA STAR assessment documents or evaluates security controls, while a penetration test actively probes a defined system for exploitable weaknesses. The two can support each other, but they do not serve the same purpose.
Source: https://qualysec.com/csa-star-assessment/