CSA STAR v4.1 Explained: Key Updates for Cloud Security and Assurance

The Cloud Security Alliance (CSA) created the Security, Trust, Assurance, and Risk (STAR) program in August of 2011 to improve transparency and security within cloud computing. This program was built upon the Cloud Controls Matrix (CCM), a selection of cloud controls designed to secure cloud service providers and customers, and is mapped to major standards like ISO 27001.

Furthering their mission, CSA STAR became a public registry for cloud providers to submit self-assessments and has continued to evolve with cloud computing advancements, as demonstrated by its latest version, CSA STAR v4.1, announced in late January 2026.

In this blog post, we’ll explore the new CCMv4.1 release, including its key updates and what cloud service providers need to know for a smooth transition.

What Is CSA STAR and Why It’s Important

CSA STAR certification enables providers to demonstrate compliance with industry best practices and validate their security posture through self-assessment, third-party audits, and continuous monitoring.

CSA STAR is important for cloud service providers and customers alike as it helps strengthen trust and transparency between the two while also providing easily accessible assessment proof to prospective partners. CSA STAR helps to connect your major standards and assessments by bridging any gaps from your annual SOC and ISO audits to cloud computing and providing a more comprehensive risk management approach.

We’ll dive into the latest iteration of the CCM, version 4.1, below and outline what changed and what these updates mean for the cloud and its providers.

CSA STAR v4.1 Updates

The latest iteration of the CCM brings an increase in controls (now totaling 207) and sweeping updates to enhance clarity around what exactly should be addressed. The CAIQ, Level 1 self-assessment, has also been updated accordingly, with version 4.1 now featuring 283 questions.

An important consideration for those already complying with the STAR program is understanding when they need to update to CCMv4.1. CSA has established a two-year transition period from the release of the CCM, meaning come January 2028, implementation of CCMv4.1 will be required to maintain your registration. Beginning in July 2027, all new CSA STAR applicants must use CCMv4.1.

Net New Controls in CSA STAR V4.1

CCMv4.1 comes with 11 net new controls aimed at extending the coverage across critical domains like Logging and Monitoring and Security Incident Management, including:

1. AIS-08: API Security
2. DCS-01: Physical and Environmental Security Policy and Procedures
3. DCS-17: Datacenter Metrics
4. DCS-18: Datacenter Operations Resilience
5. LOG-08: Audit Logs Sanitization
6. SEF-07: Incident Management and Response
7. SEF-09: Incident Records Management
8. STA-01: Supply Chain Risk Management Policies and Procedures
9. STA-09: Service Bill of Material (BOM)
10. TVM-04: Threat Analysis and Modelling
11. TVM-10: Threat Response

While the objectives and requirements within did not see much in the way of domain naming changes to controls, Infrastructure & Virtualization Security (IVS) has seen a domain name update to Infrastructure Security (I&S).

Key Control Changes in CSA STAR V4.1

In addition to the net new controls and minor updates to control ID number and verbiage, CCMv4.1 has introduced new topics to enhance the coverage and breadth of existing controls. Below is a list of these topics, highlighting the new or major control changes in specific domains:

Application & Interface Security

• AIS‑04: Secure Application Development Lifecycle
  • What has changed: Updated guidance distinct from version 4 “Secure Application Design and Development”
• AIS‑08: API Security (New)

Cryptography, Encryption & Key Management

• CEK‑03: Data Protection
  
  • What has changed: Version 4 CEK‑03 was Data Encryption; the scope is now broader
• CEK‑08: Service Customer Key Management Capability
  • What has changed: Version 4 CEK‑08 was “CSC Key Management Capability”; version 4.1 clarifies the specific role and increases the scope of the control

Datacenter Security

• DCS‑01: Physical and Environmental Security Policy and Procedures (New)
• DCS‑12: Adverse Event Response Training
  
  • What has changed: Increased scope from version 4 DCS‑11 “Unauthorized Access Response Training”; version 4.1 shifts focus to a broader scope of adverse events
• DCS‑17: Datacenter Metrics (New)
• DCS‑18: Datacenter Operations Resilience (New)

Identity & Access Management

• IAM‑12: Unique Identities
  
  • What has changed: Version 4 “Uniquely Identifiable Users” sat in IAM‑13; version 4.1 has updated and renumbered this to IAM-12
• IAM‑14: Credentials Management
  
  • What has changed: Consolidation and renaming of version 4 controls IAM‑15 “Passwords Management” and IAM‑02 “Strong Password Policy and Procedures”

Logging and Monitoring

• LOG‑08: Audit Logs Sanitization (New)

Security Incident Management, E‑Discovery, & Cloud Forensics

• SEF‑07: Incident Management and Response (New)
• SEF‑09: Incident Records Management (New)

Supply Chain Management, Transparency, & Accountability

• STA‑01: Supply Chain Risk Management Policies and Procedures (New; version 4.1 introduces explicit supply chain risk management policy coverage)
• STA‑09: Service Bill of Material (BOM) (New)
• STA‑13: Supply Chain Compliance Assessment
  • What has changed: Scope and title change from version 4 “Internal Compliance Testing” to include broader supply‑chain compliance

Threat & Vulnerability Management

Threat & Vulnerability Management has undergone significant rework in CSA STAR v4.1. A new focus on threat modeling and risk response, aimed at enabling organizations to more proactively identify and effectively manage new threats, has been established throughout the domain.

• TVM‑02: Malware and Malicious Instructions Protection Policy and Procedures
  • What has changed: Version 4 focused on “Malware Protection”; version 4.1 expands this with the addition of “Malicious Instructions” and policy/program language
• TVM‑04: Threat Analysis and Modelling (New)
• TVM‑10: Threat Response (New)

What CSA STAR v4.1 Means for Cloud Service Providers

The changes and additions in CSA STAR v4.1 most notably signal increased security coverage. While many of the updates seem minor, the new specifications and framing provide cloud service providers with much broader and stronger security coverage. This also helps to better align the CCM with modern standards, furthering the mapping and cross coverage between major frameworks like SOC and ISO.

How to Prepare for CSA STAR v4.1

Following this release, the next step is planning for the transition. Performing an analysis of the new requirements in the CCM and CAIQ will help identify gaps in your control frameworks against the new CCM, providing a baseline of your cloud security posture.

After performing a gap analysis and establishing a transition plan, the process to register your Level 1 or update your Level 2 registration will feel familiar. CSA STAR still starts with your Level 1 self-assessment, involving the submission of your completed CAIQ which helps ensure secure operation of your cloud service and provides you with the foundation of your cloud security posture as an organization and to external parties. This is still the required first step to continue or begin your journey to Level 2 certification.

If you’re ready to begin your CSA STAR certification journey, Schellman can help. Contact us today to learn more about our services and we’ll get back to you shortly. In the meantime, to further understand some of CSA STAR’s other complexities and better prepare for certification, check out our additional helpful content here:

• CSA STAR Certification vs. CSA STAR Attestation
• Relationship Between CSA Star and ISO 27001
• The CSA STAR Program: Certification & Attestation