ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
CSA STAR vs SOC 2 is a question cloud providers ask once a buyer’s security questionnaire asks for one and the salesperson promises the other. The two are often presented as rivals, but they are closer relatives than most people realize: one of the STAR assurance options is built directly on SOC 2.
This guide explains what each one is, how they connect, where they differ in scope, validity and audience, and how to decide. It is written for security and compliance leads at SaaS and cloud companies. Costs and timelines are typical ranges, not quotes, and program rules can change, so check the current terms with the Cloud Security Alliance and your auditor.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
The Security, Trust, Assurance and Risk program, known as STAR, is run by the Cloud Security Alliance. It is a public registry and assurance program for cloud providers, built around the Cloud Controls Matrix, which is the framework of cloud-specific security controls. The program has two main levels. Level 1 is a self-assessment using the Consensus Assessments Initiative Questionnaire. Level 2 is a third-party audit.
Level 2 has two main routes. STAR Certification uses ISO/IEC 27001 with the Cloud Controls Matrix, and is described on the program page as valid for three years. STAR Attestation uses SOC 2 criteria with the matrix, and is described as valid for one year. Our guides to STAR Level 1 and STAR Level 2 cover the mechanics, and the Cloud Controls Matrix page explains the control framework.
SOC 2 is an attestation report, not a certification. A licensed CPA firm examines the controls you describe against the AICPA Trust Services Criteria, with security as the required category and availability, processing integrity, confidentiality and privacy as optional ones. A Type 1 report evaluates the design of controls at a point in time, and a Type 2 report evaluates operating effectiveness over a period.
SOC 2 is the default ask in North American B2B software sales. Buyers receive the full report under an NDA and read the auditor’s opinion, the system description and the test results. Because it is a report rather than a badge, the detail is what matters.
The two are not mutually exclusive. STAR Attestation uses SOC 2 criteria as its foundation and adds the Cloud Controls Matrix. In practice, a provider that already has a SOC 2 report can extend the engagement to map and test against the matrix, which produces a STAR Attestation listing on the registry, rather than starting a second audit from scratch. Ask your audit firm whether it offers that extension.
That overlap is why the choice is often about what to add, not what to replace. A SOC 2 report gives buyers the detailed audit opinion; a STAR listing gives them a public, searchable signal that you have taken the cloud-specific controls seriously. The STAR registry shows how listings appear.
| Aspect | CSA STAR | SOC 2 |
|---|---|---|
| Owner | Cloud Security Alliance program and public registry | AICPA criteria, issued by a licensed CPA firm |
| Nature | Program with self-assessment and third-party levels | Attestation report on controls |
| Control basis | Cloud Controls Matrix | Trust Services Criteria |
| Level 1 | Self-assessment using the CAIQ | Not applicable |
| Third-party route | STAR Certification on ISO 27001; STAR Attestation on SOC 2 | SOC 2 Type 1 or Type 2 report |
| Visibility | Public registry listing | Report shared under NDA |
| Typical validity | One year for Attestation; three years for Certification | Period covered by the report; buyers expect it annually |
The first difference is audience. SOC 2 is demanded mainly by US and Canadian buyers, while STAR is recognized among cloud buyers and procurement teams that use the matrix or ISO-based requirements, including many outside North America. The second is visibility: STAR entries are public, while SOC 2 reports are confidential.
The third is control content. The Trust Services Criteria are principle-based and let the provider define controls. The Cloud Controls Matrix is more specific to cloud technology and supply chain. The fourth is entry level: STAR Level 1 lets you publish a self-assessment at low cost, although it is not independently verified. There is no equivalent lightweight level in SOC 2, where even a Type 1 requires a CPA examination.
Finally, think about what each is not. Neither guarantees that you are secure, and neither is a legal compliance certificate. Both are evidence that you have controls and that someone checked them.
As typical ranges, a first SOC 2 Type 2 engagement involves readiness work, tooling and an audit fee and is usually measured in months because the observation period must elapse. STAR Level 1 can be completed in weeks because it is a self-assessment. STAR Attestation adds the matrix mapping and testing on top of SOC 2. STAR Certification with ISO 27001 requires building and certifying a management system, which takes longer than a SOC 2 for most first-time providers. See CSA STAR certification cost for detail on budgets.
These durations depend on your starting maturity, so treat them as illustrative. The cheapest path is usually the one that reuses an audit you already need.
Let your buyers decide. Read the last ten security questionnaires and contracts you received and count which credential they name. If most name SOC 2, start there. If buyers in Europe, Asia or government ask for STAR or ISO 27001, plan for STAR Certification or a STAR listing.
A sensible sequence for many SaaS companies is: complete the CAIQ and publish STAR Level 1 to answer questionnaires quickly, obtain SOC 2 Type 2 for the core market and then add the STAR Attestation. Use your CAIQ answers as a reusable library; our page on the CAIQ answer library shows the idea.
The program now also includes STAR for AI, built on the AI Controls Matrix and ISO/IEC 42001, with a self-assessment level and a third-party level. If you deliver AI features in your cloud service, buyers may ask about it. Read the AI Controls Matrix and Valid-AI-ted guides before you decide whether to add it.
Both paths rest on the same foundations: policies, procedures, risk assessments, access reviews, change management, incident response and vendor management. The CSA STAR Toolkit includes editable templates across those cloud security domains, so one document set can support STAR and feed a SOC 2 audit.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
For the official description of the program levels, see the Cloud Security Alliance STAR program page. Whichever route you choose, agree scope in writing with your auditor before you begin, and make sure your system description matches what you really operate.
Imagine a 60-person SaaS company selling workflow software to mid-market customers in the US and to a few European enterprises. Its first deals ask only for a security questionnaire. The team completes the CAIQ and publishes a STAR Level 1 entry, which answers most questionnaires in a day. A large US customer then asks for SOC 2, so the company runs a readiness review, operates the controls for the observation window and receives a Type 2 report. A year later, a European enterprise asks for something recognizable in its own procurement language, and the company extends the audit to add the Cloud Controls Matrix, obtaining STAR Attestation. In this example, the CSA STAR vs SOC 2 question was never either or; each step reused the last. The sequence and company details are illustrative.
Procurement and security teams read different things. Security reviewers open the SOC 2 report and look at the opinion, the exceptions and whether your subservice organizations are carved out. Procurement teams search the STAR registry and check the level, the scope and the dates. Prepare for both by keeping a one-page summary of your assurance status, the scope of each listing or report, the audit period and a named contact. Update it each time a report or listing renews so nobody in sales is quoting a stale date.
Store evidence once and map it to several frameworks. A single quarterly access review, a single vulnerability scan report and a single incident response test can support SOC 2 criteria, Cloud Controls Matrix domains and ISO 27001 controls at the same time. Maintain a mapping table that lists each piece of evidence, the control it supports in each framework and its owner. This reduces audit fatigue, shortens each engagement and makes it easier to add another assurance option later.
Providers often assume STAR replaces SOC 2 or that Level 1 is equivalent to an audit. It is not; it is self-declared. Another mistake is buying separate audits with separate evidence sets. A third is letting the listing go stale: attestation and certification have validity periods, and an expired listing hurts more than no listing. Finally, do not let the scope in your STAR entry differ from your SOC 2 scope without a reason buyers can understand.
No. STAR is a program and public registry based on the Cloud Controls Matrix. SOC 2 is an attestation report on the Trust Services Criteria. STAR Attestation is built on SOC 2.
A SOC 2 engagement can be extended with the Cloud Controls Matrix to earn STAR Attestation. Ask your audit firm whether it offers this.
No. Level 1 is a self-assessment using the CAIQ. Level 2 involves a third-party audit.
It depends on the market. North American software buyers ask for SOC 2 most often, while cloud and procurement teams elsewhere also ask for STAR or ISO 27001.
The program describes STAR Attestation as one year and STAR Certification as three years. SOC 2 reports cover an audit period and are typically renewed annually.
October 1, 2026
