CSA STAR

Cloud threat/vulnerability management, supply chain management, asset inventory, encryption.


Region	International
Country or scope	International
Sector	Cloud
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CSA STAR

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for CSA STAR.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for CSA STAR and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`STAR-DCS-INV` Asset Cataloguing	STAR assessment against the CCM requires a maintained catalogue of assets, including the software components composing cloud services (CSA STAR / CCM v4, DCS domain - asset inventory)	Scan
`STAR-TVM-ID` Threat and Vulnerability Correlation	Threat and vulnerability management processes must be able to map advisories to deployed software, requiring standard identifiers (PURL/CPE) on components (CSA STAR / CCM v4, TVM domain)	Scan
`STAR-TVM-VER` Patch Level Visibility	Vulnerability remediation and patch management require the exact version of each component to be recorded (CSA STAR / CCM v4, TVM domain - vulnerability remediation)	Scan
`STAR-STA-SUP` Supply Chain Transparency	STA controls require transparency over the provider's supply chain, including attribution of software components to their upstream suppliers (CSA STAR / CCM v4, STA domain)	Scan
`STAR-CEK-INT` Cryptographic Integrity Evidence	Cryptography and key-management controls extend to using cryptographic means to protect and verify data and software integrity, evidenced by component hashes (CSA STAR / CCM v4, CEK domain)	Scan
`STAR-REG-DOC` Registry Evidence Provenance	STAR registry submissions are dated assurance artefacts; supporting SBOMs must record their creator and creation time to be usable as evidence (CSA STAR program - assessment evidence requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CSA-IAM-01`	Establish Identity and Access Management Policy
`CSA-IAM-02`	Implement Centralized Identity Provider
`CSA-DSP-01`	Classify and Protect Data Stored in Cloud
`CSA-TVM-01`	Implement Cloud Vulnerability and Threat Management
`CSA-IVS-01`	Segregate Cloud Network Environments
`CSA-LOG-01`	Enable and Centralize Cloud Audit Logging
`CSA-CCC-01`	Manage Cloud Change Control and Configuration
`CSA-BCR-01`	Define Cloud Business Continuity and Disaster Recovery
`CSA-GRC-01`	Maintain Cloud Governance Risk and Compliance Program
`CSA-SEF-01`	Define Cloud Security Incident Response

Policy templates

Written for CSA STAR:

Cloud Shared Responsibility Policy (CSA STAR)
Cloud Security Incident Response Policy (CSA STAR)

And 22 from the standard set, adapted to CSA STAR.