CSA STAR Level 1 is a self-assessment: you answer the Consensus Assessments Initiative Questionnaire (CAIQ) about your cloud service and publish it to the Cloud Security Alliance registry. No auditor checks it. It can save you repeat questionnaire work, but buyers will read it as your own statement, not as independent assurance.
What Level 1 actually is
The Cloud Security Alliance describes STAR as a registry of the security and privacy controls of cloud offerings, built on its Cloud Controls Matrix (CCM). At Level 1, an organization submits a CAIQ based on the CCM. CSA positions this level for organizations in a low-risk environment that want more transparency.
One detail trips people up. CSA states that the bundled spreadsheet containing both the CAIQ and the CCM is reference only and cannot be used to submit to the registry. Download the current CAIQ v4 on its own and check CSA's submission instructions before you start.
Level 1 versus Level 2
| Level 1 | Level 2 | |
|---|---|---|
| Method | Self-assessment | Third-party audit |
| Evidence of review | None by an outside party | Independent assessor |
| Intended risk level | Low-risk environments | Medium to high risk, or firms already holding an audit report or certificate |
| Variations | CAIQ submission | STAR Attestation (SOC 2), STAR Certification (ISO/IEC 27001) |
The practical reading: Level 1 shows you have thought about the same control domains a buyer cares about. Level 2 builds on audit work you have already done. Check CSA's own pages for current terms, because programs change.
When publishing helps a startup
A published CAIQ helps when buyers in your pipeline already use that questionnaire, or when you answer the same cloud security questions every month. You can reply with a link and a short note instead of retyping answers. CSA itself says the registry is meant to reduce the need to fill out multiple customer questionnaires.
It helps less when your buyers insist on a report from an auditor. A self-assessment will not replace that, and presenting it as if it did will cost you trust.
How to do it without overclaiming
- Answer each CAIQ line from evidence you can show today, not from your intentions.
- Mark controls that do not apply, and say why in the notes field.
- Have an engineer and whoever owns compliance review the answers together.
- Describe the entry on your site as a self-assessment, in those words.
- Re-review it at least once a year and when your architecture changes.
Do not write "STAR certified" or "STAR compliant" next to a Level 1 entry. Those phrases suggest third-party assurance that Level 1 does not provide.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how one control and its evidence can satisfy lines in several frameworks, which is the idea behind reusing a CAIQ.
Safeguard's compliance and evidence automation keeps control evidence tied to your systems, so questionnaire answers have something current behind them. You can also run the free scan on a repository to see the dependency data a buyer might ask about.
Quick check
Does a Level 1 listing mean the auditor checked us?
No. Level 1 is a self-assessment. Only Level 2 involves a third-party audit.
Can I submit the combined CAIQ and CCM spreadsheet?
CSA says that combined spreadsheet is reference only and cannot be used to submit to the registry. Use the CAIQ as CSA directs.
Sources
- Cloud Security Alliance, CSA STAR: Level 1 and Level 2 definitions, registry purpose, CAIQ submission note. Paraphrased.
Last reviewed: 19 October 2026.
