CSA CCM & STAR — Cloud Security Assurance for SaaS and Cloud Providers
The Cloud Controls Matrix is the Cloud Security Alliance’s control framework for cloud computing. Publishing a STAR entry — a CAIQ self-assessment or a third-party STAR certification or attestation — is a recognised way for SaaS and cloud providers to answer customer security questions once.
Mutex Systems prepares the CAIQ, maps CCM to your ISO 27001 or SOC 2 programme, and secures the cloud environment the controls describe.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- Cloud Security Alliance
- Current Version
- CCM v4 with the STAR registry (Level 1 self-assessment, Level 2 third-party)
- Who It's For
- SaaS companies, cloud service providers and MSPs that receive frequent customer security questionnaires.
Core Domains
A Practical Compliance Path
- 01
Map
Map CCM controls to your existing ISO 27001 or SOC 2 controls.
- 02
Close gaps
Fix cloud-specific gaps such as shared responsibility and tenant isolation.
- 03
CAIQ
Complete and publish the questionnaire on the STAR registry.
- 04
Level 2
Extend your ISO 27001 or SOC 2 audit to STAR Level 2.
Answer security questionnaires once
A strong STAR entry shortens enterprise sales cycles by pre-answering the questions buyers ask.
- CAIQ preparation
- Cloud configuration hardening
- Level 2 alongside ISO 27001 or SOC 2
Cloud controls checked against real configuration
grComply’s Cloud posture area checks AWS, Azure and Google Cloud against CIS benchmarks, and maps the results to CCM and your other frameworks.
- Cloud configuration checks against CIS benchmarks
- CCM controls cross-mapped to ISO 27001 and SOC 2
- Evidence reused across questionnaires and audits
- Findings tracked to remediation
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About CSA CCM & STAR
What is the difference between STAR Level 1 and Level 2?
Level 1 is a self-assessment published on the STAR registry. Level 2 is independently audited — a STAR certification based on ISO 27001 or a STAR attestation based on SOC 2.
Does CSA STAR replace ISO 27001 or SOC 2?
No. STAR Level 2 builds on them by adding cloud-specific controls, so it is usually added to an existing ISO 27001 or SOC 2 programme.
Ready to Start Your CSA CCM & STAR Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.