CSA STAR Attestation (SOC 2 + CCM)
A SOC 2 examination that adds the Cloud Security Alliance Cloud Controls Matrix as additional criteria, performed by a firm on CSA’s approved assessment firm list, so you can list at STAR Level 2 on the CSA registry that cloud buyers check.
Available once Tang Advisory’s CSA listing is complete.
- Criteria
- Public CSA Cloud Controls Matrix v4
- Report
- SOC 2 Type I or II with CCM section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs CSA STAR Attestation?
Cloud service providers in enterprise deals
Procurement checks the STAR registry before they open your SOC 2. An empty result is a question you have to answer.
Companies already at STAR Level 1
You published a CAIQ self-assessment. Level 2 adds an independent CPA attestation on top of your own answers.
Multi-cloud and infrastructure platforms
Buyers want cloud-specific criteria such as virtualization, interoperability and data portability that a plain SOC 2 does not name.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section addressing your controls against the Cloud Controls Matrix v4 domains, based on the mapping management prepares
- Test results for the CCM-specific controls, such as supply chain management, data portability and infrastructure virtualization
- A report in the form CSA requires for a STAR Level 2 Attestation listing, with CCSK-credentialed engagement leadership
What it is not
Not STAR Certification, which is the ISO 27001-based route issued by an accredited certification body, and not a CSA endorsement of your product. STAR Attestation is a SOC 2 report with CCM criteria, performed by a firm on CSA’s approved assessment firm list. You submit it to CSA, which maintains the listing and invoices its registry fee separately.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Level 1 first
You publish a CAIQ self-assessment on the registry. CSA requires Level 1 before a Level 2 listing.
- 2
Mapping
You map your controls to the Cloud Controls Matrix v4. We evaluate the mapping and can share a template crosswalk, but the mapping is management’s.
- 3
Examination
CCM-mapped controls are tested in the same fieldwork as your SOC 2.
- 4
Registry
Signed SOC 2+ report issued. You submit it to CSA, which invoices its registry fee separately. Listings expire after one year unless updated.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Planning a STAR registry listing?
Schedule a free 30-minute preliminary scope discussion. We will walk through the Level 1 step, what CSA requires for Level 2, and where Tang Advisory’s CSA listing stands.