Compliance Csa Star

---
name: compliance-csa-star
description: Assess CSA STAR readiness against the Cloud Controls Matrix v4 domains, choose between STAR Level 1 and Level 2, and map to existing ISO 27001 or SOC 2 controls. Use when a cloud provider wants a CSA STAR registry listing or STAR certification and needs to know which level to target. Not for a one-off customer questionnaire; see /compliance-compliance-questionnaire.
metadata:
  argument-hint: "[project] [--skip-checks]"
  workflow: compliance
  phase: 1
  artifact: 01-assess/
---

# CSA STAR Assessment

Assess CSA STAR (Security, Trust, Assurance, and Risk) compliance for "$ARGUMENTS". Evaluate against the Cloud Controls Matrix (CCM) v4 domains and complete a Consensus Assessments Initiative Questionnaire (CAIQ) self-assessment.

**Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `<project>` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use `<project>`. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"<ISO timestamp>","skill":"compliance-csa-star","workflow":"compliance","phase":1,"project":"<project>","event":"skipped","artifact":"01-assess/","note":"<reason or \"none given\">"}`.

## Prerequisites

**Part of a workflow.** This skill is phase 1 (Assess) of the GRC Lifecycle workflow (`compliance`); cross-domain workflows run it too. First check `.singularskills/log.jsonl` for an open run for this project: a `run-started` line with `"project":"<project>"` and no later `run-finished` line for the same `workflow` and `project`. If one exists, the conductor is running you: continue here. Otherwise, if the user asked to start, run, continue or resume a process or workflow rather than this one step, do not continue here: invoke the `workflow` skill with the workflow the user asked for, or `compliance` when they named none, followed by `<project>`; it runs this phase in order, asks before it writes and records the run. Otherwise continue here: a later phase runs on its own, behind its gate.

Run this skill's gate before writing: `sh <this skill's folder>/scripts/gate.sh <project> <project root>`, where `<project root>` is the folder that contains `.singularskills/` (use `.` when you are already there). If it exits non-zero, stop and tell the user what it printed, unless `--skip-checks` was given (see Arguments). On a refusal, before you stop, append this line to `.singularskills/log.jsonl` (create the folder and file if missing): `{"ts":"<ISO timestamp>","skill":"compliance-csa-star","workflow":"compliance","phase":1,"project":"<project>","event":"refused","artifact":"01-assess/","note":"<what the gate printed>"}`. Once the gate has passed, or under `--skip-checks` once you have appended the `skipped` line, append this line before you start work: `{"ts":"<ISO timestamp>","skill":"compliance-csa-star","workflow":"compliance","phase":1,"project":"<project>","event":"started","artifact":"01-assess/","note":""}`.

Read `.singularskills/compliance/<project>/00-scope.md`. If this file does not exist, tell the user:

> Phase 0 (Scope) has not been completed for "<project>". Run `/compliance-regulatory-landscape <project>` first, or use `--skip-checks` to bypass.

## Process

1. **Read context files:**
   - Read `references/grc-lifecycle-guide.md` for GRC methodology reference
   - Read `references/assessment-template.md` for output structure
   - Read `.singularskills/compliance/<project>/00-scope.md` for scope and control framework context

2. **STAR level determination:**
   - Assess current maturity to determine target STAR level:
     - Level 1: Self-Assessment (CAIQ submission)
     - Level 2: Third-Party Audit (based on SOC 2 or ISO 27001)
     - Level 3: Continuous Monitoring (future standard)
   - Document rationale for target level

3. **Cloud Controls Matrix (CCM) v4 assessment:**
   - **Application & Interface Security (AIS)** — assess application security, API security, data integrity
   - **Audit Assurance & Compliance (AAC)** — assess audit planning, independent audits, compliance mapping
   - **Business Continuity Management (BCM)** — assess business continuity planning, testing, redundancy
   - **Change Control & Configuration (CCC)** — assess change management, configuration baselines, unauthorized change detection
   - **Data Security & Privacy (DSP)** — assess data classification, handling, retention, deletion, privacy
   - **Encryption & Key Management (EKM)** — assess encryption standards, key management lifecycle
   - **Governance, Risk & Compliance (GRC)** — assess governance framework, risk management, policy management
   - **Human Resources (HRS)** — assess background checks, training, acceptable use, offboarding
   - **Identity & Access Management (IAM)** — assess identity lifecycle, authentication, authorization, privilege management
   - **Infrastructure & Virtualization (IVS)** — assess network security, virtualization hardening, workload security
   - **Interoperability & Portability (IPY)** — assess data portability, API interoperability, vendor lock-in mitigation
   - **Mobile Security (MOS)** — assess mobile device management, BYOD, mobile application security
   - **Security Incident Management (SEF)** — assess incident response, forensics, notification procedures
   - **Supply Chain Management (STA)** — assess supply chain risk, vendor assessment, data supply chain
   - **Threat & Vulnerability Management (TVM)** — assess vulnerability scanning, penetration testing, threat intelligence
   - **Universal Endpoint Management (UEM)** — assess endpoint security, patching, monitoring
   - Score each domain: Implemented / Partially Implemented / Not Implemented

4. **CAIQ self-assessment:**
   - Complete CAIQ responses for all applicable CCM controls
   - Document evidence references for each "Yes" answer
   - Provide implementation details for partial implementations
   - Document planned remediation for "No" answers

5. **ISO 27001 / SOC 2 mapping (for Level 2):**
   - Map CCM controls to existing ISO 27001 Annex A controls or SOC 2 trust services criteria
   - Identify controls already covered by existing certifications
   - Highlight incremental controls needed beyond existing certifications

6. **Write the artifact** to `.singularskills/compliance/<project>/01-assess/csa-star.md` following the assessment template structure with:
   - **STAR Level Target** — selected level with rationale
   - **CCM Domain Assessment** — all 16 domains scored with findings
   - **CAIQ Self-Assessment Summary** — completion status and key responses
   - **Certification Mapping** — overlap with ISO 27001 / SOC 2
   - **Overall Compliance Score** — score = (Implemented + 0.5 × Partially Implemented) ÷ the CCM domains, as a percentage; show it with a heatmap
   - **Remediation Priorities** — ranked list of gaps to address

## Output

The CSA STAR assessment written to `.singularskills/compliance/<project>/01-assess/csa-star.md`. Present a summary to the user highlighting:
- Target STAR level and readiness
- CCM compliance percentage by domain
- Top 3 domain gaps
- Overlap with existing ISO 27001 or SOC 2 controls

**Record the run.** After you have written the artifact, append this line to `.singularskills/log.jsonl` (the `started` line of Prerequisites, with `"event":"finished"`): `{"ts":"<ISO timestamp>","skill":"compliance-csa-star","workflow":"compliance","phase":1,"project":"<project>","event":"finished","artifact":"01-assess/","note":""}`.

Open the artifact with this frontmatter (`agent` is the agent you run in, or `unknown`; `gate` is `passed` when the gate ran clean and `skipped` under `--skip-checks`):

```yaml
---
skill: compliance-csa-star
workflow: compliance
phase: 1
project: <project>
started: <ISO timestamp>
finished: <ISO timestamp>
agent: <the agent you run in, or "unknown">
gate: <passed|skipped>
---
```

End the artifact with `## Decisions` and `## Open questions`, in this shape:

```markdown
## Decisions
- <what was chosen> — <why> — <what was rejected>

## Open questions
- <what the next phase or a reviewer must settle>
```

End the artifact with this paragraph, verbatim:

> **Not legal or audit advice.** This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.