The Cloud Security Alliance's Security, Trust, Assurance and Risk (STAR) programme is the world's most comprehensive cloud-specific security assurance framework. Built on the Cloud Controls Matrix (CCM v4) — 197 control specifications across 17 domains — STAR provides three levels of assurance: Level 1 (Self-Assessment via CAIQ), Level 2 (Third-Party Audit combining CSA CCM + ISO 27001 or SOC 2), and Level 3 (Continuous Monitoring, in development).
For Indian cloud providers, managed service firms, and SaaS companies, CSA STAR Level 2 certification is increasingly required in enterprise procurement — particularly for US, EU, and Singapore clients conducting cloud vendor due diligence. The CCM maps directly to ISO 27001 Annex A, NIST CSF, and GDPR, making joint implementation highly efficient. The CAIQ (Consensus Assessments Initiative Questionnaire) is freely available and widely used as a vendor security questionnaire response.