Written by Mike Somody.
The Cloud Security Alliance (CSA) created the Security, Trust, Assurance, and Risk (STAR) program in August of 2011 to improve transparency and security within cloud computing. This program was built upon the Cloud Controls Matrix (CCM), a selection of cloud controls designed to secure cloud service providers and customers, and is mapped to major standards like ISO 27001.
Furthering their mission, CSA STAR became a public registry for cloud providers to submit self-assessments and has continued to evolve with cloud computing advancements, as demonstrated by its latest version, CSA STAR v4.1, announced in late January 2026.
In this blog post, we’ll explore the new CCMv4.1 release, including its key updates and what cloud service providers need to know for a smooth transition.
CSA STAR certification enables providers to demonstrate compliance with industry best practices and validate their security posture through self-assessment, third-party audits, and continuous monitoring.
CSA STAR is important for cloud service providers and customers alike as it helps strengthen trust and transparency between the two while also providing easily accessible assessment proof to prospective partners. CSA STAR helps to connect your major standards and assessments by bridging any gaps from your annual SOC and ISO audits to cloud computing and providing a more comprehensive risk management approach.
We’ll dive into the latest iteration of the CCM, version 4.1, below and outline what changed and what these updates mean for the cloud and its providers.
The latest iteration of the CCM brings an increase in controls (now totaling 207) and sweeping updates to enhance clarity around what exactly should be addressed. The CAIQ, Level 1 self-assessment, has also been updated accordingly, with version 4.1 now featuring 283 questions.
An important consideration for those already complying with the STAR program is understanding when they need to update to CCMv4.1. CSA has established a two-year transition period from the release of the CCM, meaning come January 2028, implementation of CCMv4.1 will be required to maintain your registration. Beginning in July 2027, all new CSA STAR applicants must use CCMv4.1.
CCMv4.1 comes with 11 net new controls aimed at extending the coverage across critical domains like Logging and Monitoring and Security Incident Management, including:
While the objectives and requirements within did not see much in the way of domain naming changes to controls, Infrastructure & Virtualization Security (IVS) has seen a domain name update to Infrastructure Security (I&S).
In addition to the net new controls and minor updates to control ID number and verbiage, CCMv4.1 has introduced new topics to enhance the coverage and breadth of existing controls. Below is a list of these topics, highlighting the new or major control changes in specific domains:
Threat & Vulnerability Management has undergone significant rework in CSA STAR v4.1. A new focus on threat modeling and risk response, aimed at enabling organizations to more proactively identify and effectively manage new threats, has been established throughout the domain.
The changes and additions in CSA STAR v4.1 most notably signal increased security coverage. While many of the updates seem minor, the new specifications and framing provide cloud service providers with much broader and stronger security coverage. This also helps to better align the CCM with modern standards, furthering the mapping and cross coverage between major frameworks like SOC and ISO.
Following this release, the next step is planning for the transition. Performing an analysis of the new requirements in the CCM and CAIQ will help identify gaps in your control frameworks against the new CCM, providing a baseline of your cloud security posture.
After performing a gap analysis and establishing a transition plan, the process to register your Level 1 or update your Level 2 registration will feel familiar. CSA STAR still starts with your Level 1 self-assessment, involving the submission of your completed CAIQ which helps ensure secure operation of your cloud service and provides you with the foundation of your cloud security posture as an organization and to external parties. This is still the required first step to continue or begin your journey to Level 2 certification.
Mike Somody is an ISO Senior Associate with Schellman. Prior to joining Schellman in 2022, Mike worked as a Senior, Business Consultant at a Big 4 Accounting firm, specializing in Technology Risk (SOX 404/ITGC compliance). Mike also led and supported various other projects, including SDLC Implementation Evaluations, Application Controls Testing, and other Internal and External IT audits. Mike additionally has experience with CSA STAR and TISAX assessments. Mike has over 6 years of experience comprised of serving clients in various industries, including Healthcare, Industrial Products, Consumer Goods, and Real Estate. Mike is now focused on ISO 27001, 9001, and 22301 certifications, as well as CSA STAR and TISAX reporting for organizations across various industries.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。