To qualify for CSA STAR attestation for a particular cloud system, the SOC 2 report must cover:

ISO/IEC 27001:2013 controls are the basis for CSA STAR Certification, not STAR Attestation; STAR Attestation is AICPA SOC 2-based and does not mandate ISO 27001 control coverage in the report.

Maturity model criteria apply to the CSA STAR self-assessment (Level 1) and continuous monitoring (Level 3) tiers, not to the SOC 2-based STAR Attestation report requirements.

CSA STAR Attestation is built on a SOC 2 engagement in which the auditor assesses both the AICPA Trust Services Principles Criteria - at minimum the Security principle - and all Cloud Control Matrix controls as additional criteria layered on top. This dual coverage ensures the attestation addresses the general IT assurance baseline provided by AICPA and the cloud-specific control requirements defined by CSA, producing a comprehensive cloud security assurance report that satisfies both frameworks simultaneously.

Pairing CCM with ISO/IEC 27001:2013 controls describes the basis for CSA STAR Certification, not STAR Attestation; STAR Attestation pairs CCM with AICPA TSPC rather than ISO standards.