STAR Level 1 is a self-assessment the vendor publishes in the Cloud Security Alliance registry. STAR Level 2 builds on an independent third-party audit. Level 1 tells you the vendor documented its controls. Level 2 adds outside assurance. Weigh them accordingly and still ask for evidence.
What the registry is
The CSA describes the STAR Registry as publicly accessible, documenting security and privacy controls of cloud services. Anyone can look a vendor up before a review starts. That alone saves time.
Level 1 in plain terms
Under Level 1, a company submits the CAIQ, a questionnaire built on the Cloud Controls Matrix, to document its own controls. The CSA recommends it for organizations operating in a low-risk environment or looking for a cost-effective way to build trust.
What it proves: the vendor sat down, answered a standard set of questions and was willing to publish the answers. What it does not prove: that the answers are true. Nobody independent has checked. Our explainer on the CAIQ covers the questionnaire itself.
Level 2 in plain terms
Level 2 uses independent, third-party audits rather than self-reporting. The CSA says it builds on other industry certifications and standards, and suggests it for medium to high risk environments and for organizations that already hold standards such as ISO 27001 or SOC 2. It carries fees.
What it proves: an outside party looked at the controls. What it still does not prove: that the controls cover the exact service and data you plan to use. Scope matters more than the badge.
How to weigh them
A simple rule of thumb for your own program, not a CSA rule:
- Low-risk vendor, no sensitive data: Level 1 plus a quick read of the answers is often enough.
- Moderate risk: Level 1 is a starting point. Ask for an independent report as well.
- High risk: prefer an independent audit, then read its scope and exceptions yourself.
Questions to ask whichever level you see
- Which product or service does the entry cover? Vendors can have several.
- When was it last updated? An old entry says little.
- Who is responsible for which controls? Look at the shared responsibility answers.
- What did the auditor test, if this is Level 2?
- Can you see the underlying report under NDA?
A note on wording
Do not write "STAR certified" in your own documents unless the vendor holds the Level 2 outcome. A Level 1 entry is a self-assessment. Mislabeling it in your vendor file will mislead the next person who reads it.
Quick check
Does STAR Level 1 mean a vendor was audited?
No. Level 1 is a self-assessment that the vendor submits and publishes.
Is STAR Level 2 enough on its own for a high-risk vendor?
Not by itself. Read the scope and findings, and confirm it covers the service you will use.
Sources
Last reviewed: 19 October 2026.
