Every cloud service provider that opts to join the CSA STAR program registry must complete a ___________.

While many cloud providers obtain SOC 2, Type 2 audit reports, it is a separate certification from AICPA and not a mandatory requirement for simply joining the CSA STAR program registry at the self-assessment level.

The Cloud Security Alliance (CSA) STAR program offers different levels of assurance. For Level 1 Self-Assessment, which is the baseline entry for joining the registry, cloud service providers must complete and publish the Consensus Assessment Initiative Questionnaire (CAIQ). The CAIQ is a comprehensive questionnaire that documents a provider's security controls.

NIST 800-37 RMF (Risk Management Framework) is a U.S. government standard for risk management, not a universal requirement for CSA STAR entry, though it can inform a provider's controls.

ISO 27001 ISMS (Information Security Management System) certification is another common security standard, but it is an independent certification and not a prerequisite for joining the CSA STAR registry as a self-assessment.