axigetik: CSA STAR for AI Support
Cabahu · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
STAR for AI extends CSA’s globally recognized Security, Trust, Assurance and Risk (STAR) program to address the unique risks of AI. Built on the AI Controls Matrix (AICM), AI-CAIQ, and ISO/IEC 42001, it provides a transparent path to evaluate and validate AI safety and governance practices.
Within STAR for AI, there are 4 distinct levels of achievement, and we can help you with all or any of them, depending on where you are in your AI security assurance journey.
Show the rest of the publisher’s description (24 more lines)
## CSA's AI Trustworthy Pledge
As the first step on CSA STAR for AI journey, an organization must sign on to the AI Trustworthy Pledge - CSA’s high-level framework of principles for responsible AI development. We can:
- Quantify the competitive advantage you would gain by signing the AI Trustworthy Pledge (ie the ROI)
- Help facilitate internal discussions, reviews and signoffs
- Identify practical implications and remediations from having signed the AI Trustworthy Pledge.
## CSA STAR for AI Level 1
CSA STAR for AI Level 1 is a foundational STAR for AI designation earned by completing and submitting the AI-CAIQ self-assessment to the STAR Registry. For CSA STAR for AI Level 1, we can:
- Help you complete the Consensus Assessment Initiative Questionnaire for AI (AI-CAIQ), which applies the AI Controls Matrix (AICM) to your specific organization
- Facilitate the submission process to the Cloud Security Alliance's STAR registry to achieve CSA STAR for AI Level 1 Certification and the right for your organization to use the CSA STAR for AI Level 1 badge.
## CSA STAR for AI Level 1 (Valid-AI-ted)
CSA STAR for AI Level 1 (Valid-AI-ted) is an enhanced version of STAR for AI Level 1, earned when an organization’s AI-CAIQ passes the Valid-AI-ted automated system. It shows structured, explainable scoring and higher transparency. For CSA STAR for AI Level 1 (Valid-AI-ted), we can:
- Explain how the CSA STAR for AI tool uses LLM technology to provide automated, actionable feedback
- Perform a dry-run assessment to identify any likely issues from the validation and remediate them in advance
- Facilitate submission process to Cloud Security Alliance's Valid-AI-ted tool for evaluating STAR Level 1 self-assessments to achieve CSA STAR for AI Level 1 (Valid-AI-ted) certification.
## CSA STAR for AI Level 2
CSA STAR for AI Level 2 the most advanced STAR for AI designation and requires both a third-party ISO/IEC 42001 certification and a Valid-AI-ted AI-CAIQ. It demonstrates global AI compliance, safety, and operational transparency. For CSA STAR for AI Level 2, we can:
- Provide you with advice and assistance on implementation of an AI Management System
- Recommend or help you select and engage qualified auditors who provide ISO/IEC 42001:2023 certifications
- Provide ISO/IEC 42001:2023 internal audit services if not precluded from doing so by impartiality requirements.
##### Specific AWS Services Addressed
CSA STAR for AI is not AWS specific and will provide a baseline position across all cloud AI services and providers. If you have a significant AWS footprint, including AI services on Sagemaker (including Studio, Custom Models, Hyperpod, Inference, MLflow), Bedrock (including Nova & Agentcore), SDKs such as Strands, or older AI services such as Comprehend, Kendra, Lex, Personalize, Polly, Rekognition, Textract, Transcribe, Translate we have specific expertise and experience in designing, implementing and operating these solutions, and can leverage AWS best practices, configurations, compliance and security tools (such as Organizations, Identity & Access Management, Config, CloudFormation, Control Tower, Security Hub) to ensure you gain maximum leverage and complete compliance during in your CSA STAR for AI process.
*Note 1: there is no cost to sign the AI Trustworthy Pledge.*
*Note 2: There may be membership agreements or fees associated with engagement with Cloud Security Alliance around STAR for AI, and these will be borne directly by your organization - we will help you understand the costs, but we do not pay them on your behalf, nor do we make any margin on them in terms of our own fees.*
*Note 3: Achievement of ISO/IEC 42001:2023 certification as pre-requisite for STAR for AI Level 2 requires separate engagement of an internal auditor and external certification service.*
Highlights
Highlighted by the publisher on AWS Marketplace.
We provide practical services and support for your CSA STAR for AI journey, from the foundation through to the most advanced certification
We bring specific expertise and experience in design, implementation and operation of AWS-based AI services
Our staff are certified implementers and auditors across multiple AI security and compliance standards
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Compliance
- FedRAMPConfirmedNot listed90%, registry-checkedNo FedRAMP Marketplace entry matched this vendor's domain, checked 2026-08-27registry recordas observed 2026-08-27
Confirmed means matched to a public authoritative registry. Claimed means the vendor or its listing states it, not yet cross-checked. A framework not shown was not found in any source we hold, which is not evidence against it. Not listed means a scoped registry check found no match for this vendor's domain: a No is a scoped registry check, not a compliance judgment. Confidence bands: 95% domain-verified, 90% registry-checked, 80% self-attested, 70% weak signal. Self-attested items marked “vendor's site” are gathered from the vendor's own website and are not verified by us.
Vendor
External enrichment · as of 2026-08-29
Sources
Linked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.