CSA STAR Level 3: Continuous Monitoring

Data centers must deploy and maintain continuous monitoring systems that collect security events and logs from all infrastructure components with minimal latency (sub-minute detection targets for critical events).

This requires SIEM or equivalent platforms with parsing rules configured for all CSA security domains, capable of processing millions of events per day while maintaining audit trail integrity and data retention for minimum 12 months.

Organizations must document baseline security metrics and establish automated alerting for deviations exceeding predefined thresholds, with escalation procedures for critical findings.

Rather than manual quarterly control testing, Level 3 mandates automated, policy-as-code validation of security controls that runs continuously against production infrastructure.

This requires organizations to define security control requirements in machine-readable formats (Infrastructure as Code scanning, compliance-as-code tools like Terraform compliance validators), execute continuous compliance assessments that test controls against current system state, and generate real-time compliance dashboards showing control status.

Each critical security control must have corresponding automated tests that execute daily or more frequently, with results feeding into governance systems.

Data centers must implement automated vulnerability scanning on all systems, networks, and applications with continuous discovery of new assets and immediate scanning of newly provisioned infrastructure.

This includes configuration management databases (CMDB) synchronized with infrastructure-as-code repositories, automated scanning for misconfigurations against CIS benchmarks and CSA guidelines, and real-time inventory of all security-relevant system states.

The requirement explicitly mandates automated remediation workflows for critical misconfigurations with human approval gates for changes exceeding defined risk thresholds.

Organizations must continuously monitor all authentication and authorization events, detecting anomalies such as impossible travel scenarios, unusual privilege elevation patterns, and access from unexpected geographic locations or networks.

This requires behavioral analytics capabilities that establish user and entity baseline behavior (UEBA), real-time enforcement of least-privilege access policies with automated session management, and continuous validation that access rights remain aligned with job functions.

Every privileged account action must be logged, monitored, and analyzed for suspicious patterns within the detection window.

Data centers must continuously validate that data classified as sensitive is encrypted both in transit and at rest, monitor encryption key lifecycle events including rotation and access, and detect attempts to access encrypted data without proper key authorization.

This includes automated scanning of data stores to identify unencrypted sensitive data, continuous monitoring of key management service (KMS) audit logs for unauthorized operations, and alerts triggered when encryption key access patterns deviate from baseline.

Organizations must maintain hardware security module (HSM) audit logs and demonstrate continuous validation of cryptographic control implementation.

Organizations must maintain 24/7 monitoring for security incidents with automated threat intelligence integration, detection of indicators of compromise (IOCs) and attack patterns, and escalation procedures triggering within defined response time windows.

This requires correlation of security events across multiple data sources to identify attack campaigns, automated playbook execution for common incident scenarios, and mandatory incident response testing that validates detection and response capabilities at least quarterly.

Evidence of continuous threat monitoring must be maintained through centralized logging and threat intelligence platform integration.

All monitoring data, control test results, and compliance evidence must be continuously collected, correlated, and maintained in immutable audit trails that cannot be modified or deleted without detection.

Data centers must implement centralized logging platforms that capture events from all systems, establish log integrity verification mechanisms (cryptographic checksums, append-only storage), and maintain compliance-relevant evidence in formats acceptable for regulatory audits.

The audit trail must support real-time query capabilities allowing auditors to reconstruct security posture for any historical time period within the retention window.

Organizations must establish formal governance procedures defining which security events trigger automatic escalation, who receives alerts at different severity levels, maximum response time windows for each severity tier, and decision-making authority for remediation actions.

These procedures must be documented, regularly tested through simulation exercises, and monitored for compliance—tracking metrics such as mean time to detection (MTTD) and mean time to resolution (MTTR) against established targets.

Level 3 certification specifically requires demonstrating continuous governance monitoring showing that escalation procedures are followed in practice.