CSA STAR Level 1: Self-Assessment

Organizations must complete and document responses to the entire CCM questionnaire spanning 197 control objectives across 16 security domains.

Each control requires detailed documentation of how the data center implements or plans to implement the control, with evidence of current state maturity levels (ranging from Not Implemented to Optimized).

Data centers must demonstrate specific technical implementations, policy documentation, and process evidence for each relevant control applicable to their service offerings.

Completed assessments must be submitted to the CSA STAR Registry for public listing, making security documentation accessible to prospective customers and partners.

Data centers must disclose their CCM questionnaire responses transparently, including specific details about physical security measures, encryption implementations, access controls, and incident response procedures.

This public transparency requirement differentiates STAR Level 1 from private audit frameworks and creates direct competitive and reputational implications for data center operators.

Data centers must document comprehensive controls addressing facility access, environmental monitoring, power protection, and physical infrastructure resilience across CCM domains GRM-01 through PHY-02.

Specific documentation requirements include facility diagrams with security zones, biometric and badge access logs, CCTV system specifications, fire suppression system certifications, UPS and backup power capacity documentation, and environmental sensor monitoring records.

These controls address the unique physical infrastructure requirements of data center operations that differ significantly from purely cloud-native software providers.

Organizations must document implementation of identity and access management controls (IAM-01 through IAM-07), cryptography standards (ENC-01 through ENC-03), and encryption key management procedures.

Data centers must specify authentication mechanisms (multi-factor authentication, certificate-based systems, federated identity protocols), encryption algorithms and key lengths deployed across data at rest and in transit, and demonstrate key rotation schedules, separation of duties in key management, and hardware security module (HSM) utilization where applicable.

Data centers must document controls from the Data Security (DSI-01 through DSI-04) domain demonstrating data classification schemes, retention policies, secure deletion procedures, and privacy-by-design implementations.

Documentation must address specific data types handled, segregation mechanisms for customer data, encryption standards applied to different data classifications, secure disposal certifications for media destruction, and GDPR/privacy compliance measures including Data Processing Agreements and Privacy Impact Assessments.

Organizations must document incident response capabilities across IVS-01 through IVS-08 controls, including incident detection and response procedures, forensic investigation capabilities, customer notification protocols, and post-incident analysis processes.

Data centers must provide evidence of incident response plan documentation, security incident log samples demonstrating detection and tracking mechanisms, evidence of staff training on incident procedures, and documented examples of past incident handling with root cause analysis completion.

Data centers must establish and document risk management processes per GRM-01 through GRM-07, including risk identification methodologies, assessment frameworks, treatment tracking, and compliance monitoring procedures.

This includes documented risk registers specific to data center operations (physical risks, environmental risks, supply chain risks), risk scoring and prioritization matrices, evidence of regular risk review cycles (minimum annual), and demonstrated linkage between identified risks and control implementation plans.

Organizations must document supply chain risk management controls (GRC-04 through GRC-05) addressing vendor assessment, contractual obligations, and ongoing monitoring.

Data centers must demonstrate vendor security questionnaires, facility inspection reports for outsourced components or colocation relationships, contractual clauses requiring equivalent security standards, and evidence of periodic vendor compliance verification through audits or assessments.

This requirement specifically addresses shared infrastructure risks in multi-tenant data center environments.