CSA2 Certification: A Complete Guide to Cloud Security

Cloud Certification · Step-by-Step Guide · March 2026

CSA STAR Level 2 certification is achievable, but only if you know what the assessors are looking for and how to prepare. This guide walks you through every phase — from understanding the Cloud Controls Matrix to surviving audit day — with the practical detail that generic overviews leave out.

💫 Key Takeaways

• CSA STAR Level 2 requires a foundation of ISO 27001 or SOC 2 — you cannot skip straight to Level 2
• The Cloud Controls Matrix (CCM) v4 contains 197 control objectives across 17 domains — but not all will apply to your scope
• The CAIQ (Consensus Assessments Initiative Questionnaire) v4 maps directly to the CCM and is the primary evidence framework
• If you already have ISO 27001, expect 2–4 months of incremental preparation for the STAR assessment
• The most common pitfall is treating CCM controls as a checkbox exercise instead of demonstrating operational maturity
• Combined audits (ISO 27001 + CSA STAR) are the most cost-effective path and reduce total audit time by 30–40%
• Preparation costs range from €10,000–€40,000; audit fees from €15,000–€60,000 depending on scope

The Cloud Controls Matrix is the backbone of everything CSA STAR. It is a cybersecurity controls framework specifically designed for cloud computing. Version 4 (the current version as of 2026) contains 197 control objectives organized into 17 domains. Understanding these domains is essential because they define the scope of your assessment.

One of the most important things to understand about the CCM is that it was designed to map to existing frameworks. Each CCM control objective includes cross-references to ISO 27001 Annex A controls, NIST SP 800-53 controls, SOC 2 Trust Services Criteria, PCI DSS requirements, and GDPR articles. This means that if you already have ISO 27001 or SOC 2, a significant portion of the CCM is already covered by your existing control environment.

The Consensus Assessments Initiative Questionnaire (CAIQ) is the operational companion to the CCM. While the CCM defines what controls you need, the CAIQ asks how you implement them. Each CAIQ question maps directly to a CCM control objective.

For Level 1, you complete the CAIQ yourself and submit it. For Level 2, the CAIQ responses become the basis for the auditor's assessment. The auditor will review your CAIQ responses, request supporting evidence for each answer, and test whether your stated controls actually work as described.

Here is what makes the CAIQ different from a typical security questionnaire:

• It demands specificity. “Yes, we do encryption” is not sufficient. The CAIQ asks which encryption algorithms, at what key lengths, how keys are managed, where they are stored, and how they are rotated.
• It covers shared responsibility. For each control, you must indicate whether it is your responsibility, your cloud provider's responsibility, or shared. This forces you to think carefully about your shared responsibility model — a common gap area in assessments.
• It includes maturity scoring. Level 2 assessments do not just ask whether a control exists — they evaluate how mature it is. A control that exists as a documented policy but is not consistently implemented or monitored will score lower than one that is fully automated and continuously verified.

CSA STAR Level 2 offers two distinct paths, each building on a different foundation. Your choice depends on what you already have and who your primary customers are.

For European companies selling primarily in the EU market, the certification track (ISO 27001-based) is almost always the right choice. ISO 27001 is the lingua franca of European information security, and adding CSA STAR Level 2 Certification on top of it creates the strongest possible cloud security posture for EU procurement.

If your company already has SOC 2 Type II and your primary market is North America (or a mix of EU and US), the attestation track may be more efficient. You can also pursue both tracks if your customer base spans both markets, though most companies choose one and reference it globally.

Here is the practical roadmap, based on the certification track (ISO 27001-based). The attestation track follows a similar structure but with SOC 2-specific audit procedures.

Phase 1: Foundation Check (Week 1–2)

Before anything else, confirm your foundation is solid:

• Is your ISO 27001 certificate current and in good standing?
• When is your next surveillance or recertification audit? (Ideal timing: combine ISO 27001 and STAR audits)
• Does your ISO 27001 scope cover the cloud services you want to certify under STAR?
• Is your Statement of Applicability (SoA) up to date?

If you do not yet have ISO 27001, that is your first priority. A virtual CISO can help you build and implement the ISMS in parallel with CSA STAR preparation, but expect a longer timeline of 9–14 months total.

Phase 2: CCM Gap Analysis (Week 2–6)

This is the most important preparation phase. Systematically compare your existing controls against each applicable CCM domain:

• Download CCM v4 and map each control objective to your existing ISO 27001 controls
• Identify gaps — controls required by the CCM that are not addressed by your current ISMS
• Assess maturity — for controls that do exist, evaluate whether they are documented, implemented, monitored, and optimized
• Define the shared responsibility model — for each control, clarify whether it is your responsibility, your cloud provider's (AWS, Azure, GCP), or shared

Phase 3: Remediation and Control Implementation (Week 6–14)

Based on the gap analysis, implement or strengthen the controls needed to close the identified gaps. This typically involves:

• Policy and procedure updates: Extend existing security policies to cover cloud-specific controls. Your encryption policy may need a dedicated section on cloud key management. Your change management procedure may need to address infrastructure-as-code deployments.
• Technical controls: Enable and configure cloud-native security tools (AWS Config, Azure Security Center, GCP Security Command Center). Implement encryption at rest and in transit where gaps exist. Configure network segmentation and micro-segmentation.
• Process improvements: Formalize the shared responsibility model documentation. Implement cloud-specific incident response procedures. Create data portability runbooks.
• Evidence collection: Start collecting evidence of control operation from day one. The auditor will want to see that controls have been operating for a reasonable period, not just implemented the week before the audit.

Phase 4: CAIQ Completion and Internal Review (Week 12–16)

Complete the CAIQ v4 questionnaire with detailed, evidence-backed responses. For each question:

• Describe what you do, how you do it, and where it is documented
• Specify the tools and technologies involved
• Identify the responsible person or team
• Reference the evidence available (logs, reports, screenshots, configurations)

Conduct an internal review by someone who was not involved in completing the CAIQ. Fresh eyes will catch inconsistencies, vague responses, and areas where the stated control does not match what is actually implemented.

Phase 5: Select Your Audit Body (Week 8–12)

Start this process early — good audit firms book out months in advance. Key considerations:

• The certification body must be on the CSA-approved list
• If possible, use the same certification body as your ISO 27001 auditor for a combined audit
• Ask about the auditor's experience with your cloud provider (AWS, Azure, GCP) and your service model (SaaS, PaaS, IaaS)
• Request a pre-assessment or readiness review if your audit body offers one — this identifies issues before the formal audit

Phase 6: The Audit (Week 16–20)

The Level 2 assessment typically involves:

• Document review: The auditor reviews your CAIQ, policies, procedures, and supporting documentation
• Interviews: Key personnel are interviewed about their roles and how controls operate in practice
• Evidence testing: The auditor verifies that controls operate as described by examining logs, configurations, reports, and other artifacts
• Maturity assessment: Each control domain is rated on a maturity scale
• Findings report: Non-conformities and observations are documented. Minor non-conformities can usually be resolved within a defined corrective action period

Phase 7: Certification and Registration (Week 20–22)

Once all findings are resolved, the certification body issues your CSA STAR Level 2 certificate. The certificate and your maturity scores are published on the CSA STAR Registry — a public, searchable database that procurement teams and regulators use to verify cloud security certifications.

Let me be direct about what this costs, because vague answers here waste everyone's time.

These figures are based on a mid-sized SaaS or cloud service provider (50–500 employees) with 1–3 cloud services in scope. Larger organizations with complex multi-cloud environments will be at the higher end or above these ranges.

Over the years, I have seen the same mistakes repeated across CSA STAR engagements. Here are the most common ones and how to avoid them:

If you already have ISO 27001 and/or SOC 2, you are not starting from zero — you are extending an existing program. Here is how to make that extension as efficient as possible.

ISO 27001 + CSA STAR Level 2 (Most Common European Path)

The CCM v4 maps directly to ISO 27001:2022 Annex A controls. Your existing Statement of Applicability (SoA) is the starting point for identifying which CCM controls are already addressed. Here is the practical approach:

• Extend your SoA to include CCM-specific controls that are not already covered by Annex A
• Update your risk assessment to include cloud-specific threats and scenarios referenced in the CCM
• Add CCM-specific procedures to your existing process documentation (rather than creating entirely new documents)
• Reuse evidence from your ISO 27001 internal audits and management reviews
• Schedule combined audits with your certification body to minimize disruption and cost

SOC 2 + CSA STAR Level 2 (Attestation Track)

If your foundation is SOC 2 Type II, the integration works differently. The CCM criteria are incorporated as additional subject matter in your SOC 2 examination. Your CPA firm evaluates the CCM controls alongside the Trust Services Criteria. This requires a CPA firm that has experience with CSA STAR attestations — not all do.

EU Cloud Code of Conduct Alignment

The EU Cloud Code of Conduct (EU Cloud CoC) is a GDPR code of conduct approved under Article 40, specifically for cloud service providers. If you are pursuing the EU Cloud CoC alongside CSA STAR, there is significant overlap in the data protection, security governance, and transparency requirements. We recommend mapping both frameworks simultaneously to identify shared controls and avoid duplicate documentation.

Ready to Start Your CSA STAR Level 2 Journey?

Whether you need a gap analysis, end-to-end preparation support, or a virtual CISO to manage the entire certification program, we have guided organizations through every phase of CSA STAR Level 2.

Book a free consultation and we will give you an honest assessment of where you stand, what it will take, and whether the timing is right for your business.

Published: March 2026 · Author: Alexander Sverdlov

This article is for informational purposes only and does not constitute legal or professional advice. Certification requirements and timelines can vary based on your specific environment and chosen audit body. For personalized guidance on CSA STAR Level 2 certification, please consult a qualified security professional.