Hello, this is Ryuta Hamamoto from TIMEWELL.
"When is Level 3 coming out? We finished Level 2 and want to go next." A security lead at a domestic cloud provider asked me that recently. Half resigned.
I will answer straight: as of May 2026, CSA STAR Level 3 is not formally released. Planned for 2023, it has been delayed for three years. Many people do not know this, and even some certification consultants answer vaguely that "Level 3 is close."
Here is the twist. The building blocks for Level 3 already exist: Continuous Audit Metrics Catalog v1.1, mapping to CCM v4.1, STAR Continuous, ENISA continuous-evidence expectations. In other words, we are waiting only for formalization as a certification scheme. Technical and operational prep can start now. That is the May 2026 reality.
Leading US and European providers already run Continuous Auditing API prototypes. Japanese companies that decide to "wait for formalization" will start 2027–2028 production a year late. This piece covers Level 3 status, SLO/SQO, API design, and tools such as Vanta and Drata from an implementation lens.
TL;DR
- Level 3 is not formally released as of May 2026. Planned for 2023; still in prep after multiple delays
- Building blocks exist: Continuous Audit Metrics Catalog v1.1 (33 metrics), CCM v4.1 mapping, STAR Continuous
- Core concepts: bind SLO (quantitative) / SQO (qualitative) to each control and collect automatically
- Prepare for formalization; do not wait for it. Prep takes 1–2 years
- Vanta (hourly tests), Drata (real-time monitoring), and similar SaaS cover parts; CSA-native CAM still needs custom work
- WARP SECURITY drills: CCM v4.1 → SLO/SQO workshops; Continuous Auditing API design exercises
Why Level 3 is still missing: three structural reasons for a three-year wait
"Planned for 2023" is the starting fact. CSA has positioned STAR Level 3 as Continuous Auditing Certification since around 2020, targeting a 2023 release. Delays ran through 2024, 2025, and into 2026; as of May 2026 there is still no formal release announcement.
Why so late? In my synthesis of public information, three structural reasons stand out.
First, continuous auditing collides with traditional auditor business models. CPA firms and ISO certification bodies earn fees from annual (or three-year) on-site audits. If audit becomes 24/7 automatic, pricing and contract forms need industry-level redesign.
Second, how to guarantee evidence integrity is still open. Continuous auditing means providers push their own logs and metrics into an audit platform. But how do you verify the provider did not tamper with evidence? Blockchain and tamper-evident logs, third-party pull of evidence in real time. Multiple designs are in flight.
Third, cross-industry consensus takes time. CSA is an open standards body; AWS, Microsoft, Google, European operators, Japan's NTT, and others must align. Alignment with EU CSA schemes, ENISA coordination, AICPA collaboration. Too many negotiation tracks.
My forecast: formal Level 3 lands somewhere in 2027–2028. That is not pessimism; complex institutional design takes time. But "three years of waiting" must not be read as "three years of vacation."
The building blocks are already here: Continuous Audit Metrics Catalog v1.1
Even without a finished certification scheme, Level 3's technical components are already public. Stopping at "Level 3 is not out yet" without knowing this cedes ground to competitors.
The core is the Continuous Audit Metrics Catalog (CAM). CSA's v1.1 defines 33 continuous audit metrics mapped to CCM v4.1 controls.
Example metrics for the IAM (Identity & Access Management) domain:
| Metric ID (example) | Content | SLO / SQO |
|---|---|---|
| IAM-M1 | MFA coverage on privileged accounts | 100% (SLO) |
| IAM-M2 | Access review frequency | Quarterly (SLO) |
| IAM-M3 | Time to disable leaver accounts | Within 24 hours (SLO) |
| IAM-M4 | Anomalous access detection quality | False positive rate < 5% (SQO) |
The point: metrics are translated into measurable numbers or statuses. Traditional ISO 27001 audits ask "is it appropriately managed?" Fuzzy. CAM says "answer with numbers." That is the core idea of continuous auditing: a shift from human-judged audit to machine-judged audit.
I treat CAM as a language converter for audit: static CCM requirements into machine-readable logs and metrics. Providers that cannot perform that translation will not respond quickly even after Level 3 formalizes.
AI Security training, taken seriously
A 2-day intensive course fully aligned with OWASP, NIST, ISO/IEC 42001, and METI. Take it as executives, practitioners, or both.
SLO and SQO: translating into "audit that answers with numbers"
CAM's core concepts are SLO (Service Level Objective) and SQO (Service Qualitative Objective). Similar names to SRE SLOs, different purpose.
SLO is a quantitative target. Example: "encryption key rotation within 90 days," "time from incident detection to notification within 4 hours."
SQO is a qualitative target. Example: "log analysis process conforms to NIST 800-92," "incident response procedures documented and reviewed annually." Evaluated by status or existence.
Why two layers? Not every control can be quantified. Log retention periods can; "is the incident response manual properly maintained?" is better as state. SLO + SQO together make the control surface visible.
In implementation, do not confuse existing SLI/SLO (service availability for customers) with continuous-audit SLO/SQO. SRE SLOs measure customer-facing availability; continuous-audit SLOs measure security-control attainment. Same word, different purpose. I recommend separate dashboards.
In my experience, translating CCM v4.1's 207 controls into SLO/SQO takes 3–6 months. You can outsource, but building it through internal debate prevents later operational deadlock. Defining SLOs forces management questions like "is this level of security enough for us?"
API design reality: Continuous Auditing API prototypes
In Level 3 operations, Continuous Auditing API design becomes decisive. Since 2025 CSA has run "STAR Continuous," with participants trial-sending SLO/SQO data to CSA on a schedule.
A common architecture:
- Metrics collection — CloudWatch, Datadog, Splunk, Prometheus, etc.
- CCM mapping — Convert raw metrics into CAM SLO/SQO formats
- Tamper detection — Hash chains, signatures, log aggregation for integrity
- API publication — Pull endpoints for auditors, or scheduled push
- Visualization — Internal dashboards; external transparency dashboards for customers
Building this internally is the real Level 3 prep. In practice, API publication schema design is the hardest piece. Without a final CSA official schema, firms build on proprietary schemas and plan later remaps.
Some conclude "waiting for formalization wastes less effort." I disagree. If you wait, internal collection pipelines will not be ready. Rewrite cost is far smaller than greenfield build time. Build early; remap schema later is faster overall.
Having an API layer is also a customer transparency asset. AWS, Google Cloud, and Azure already expose compliance reporting to customers; mid-market SaaS offering "compliance APIs" has grown through 2026. That direction is irreversible even before Level 3 formalizes.
Vanta, Drata, Secureframe: how far can existing tools go?
"Do we have to build everything in-house for Level 3?" The answer: about half can ride existing tools; the other half needs custom work.
| Tool | Monitoring frequency | Integrations | CSA STAR support |
|---|---|---|---|
| Vanta | Hourly tests | 250–375+ | Partial via SOC 2 / ISO 27001 base |
| Drata | Real-time | 75–130+ | Possible via custom frameworks |
| Secureframe | Every few hours | 200+ | Custom |
Vanta is broad and shallow; Drata is fewer integrations but deeper real-time customization; Secureframe sits in between. Common trait: native support for SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR. Native CAM support remains rare.
A practical pattern: use Vanta or Drata automated evidence for SOC 2 / ISO 27001, then write a bridge that converts reports into CCM format. For example, AWS Lambda or Cloud Functions on a schedule. Imperfect, but much faster than zero.
For mid-market SaaS I baseline: "buy Vanta or Drata, write the CCM mapping bridge yourself." Hyperscalers build deeper platforms; below that, riding tools has better ROI.
But "buy a tool and Level 3 is done" is wrong. Tools collect evidence; humans still define SLO/SQO, automation scope, and tamper-detection design. Tools are weapons; thinking is human.
Three preparations Japanese companies should start now
Assuming Level 3 formalizes in 2027–2028, reverse-plan from today. From field experience, three priorities:
Finish CCM v4.1 → SLO/SQO mapping in-house (3–6 months). Outsourcing is possible, but keep management and security at the same table. Deciding what can be numerically monitored, and how to SQO the rest, across 207 controls is a rare alignment opportunity.
Build a Continuous Auditing API prototype. Do not wait for CSA's final schema. In one month, export Vanta reports as JSON and convert to CCM format with a Lambda. When Level 3 formalizes, you adjust schema only.
Publish a customer-facing transparency dashboard. A lightweight version of AWS/Azure compliance portals, alongside your status page. Few providers show continuous monitoring depth in 2026. First movers win branding.
If you start these in 2026, Level 3 acquisition within six months of formalization is realistic. If not, plan about two years from announcement to certificate. Whether "three years of waiting" becomes "three years of rest" or "three years of preparation" is the fork right now.
Can you skip Level 2 for Level 3? No
We occasionally hear "skip Level 1 and Level 2 and go straight to Level 3." Structurally impossible. Level 3 is an extension of Level 2; Level 2 is a prerequisite.
CSA's definition requires holding Level 2. Continuous auditing continuously proves that controls verified at Level 2 remain true 24/7. Without Level 2, the audit target is undefined.
Priority is clear: Level 1 → Level 2 → Level 3. Level 2 holders can prepare for Level 3; others must finish Level 2 first. See Level 1 self-assessment and Level 2 third-party audit.
Also, embedding continuous-audit elements into Level 2 annual surveillance smooths Level 3 migration. AWS and Azure already show automated evidence collection during Level 2 periodic audits. A de facto Level 3 head start.
WARP SECURITY: Continuous Auditing API design drills
The largest Level 3 hurdle is cross-org agreement on SLO/SQO and API architecture. Security alone cannot decide. Engineering, SRE, product, and management all must engage.
TIMEWELL's WARP SECURITY runs Continuous Auditing API design drills toward Level 3, in three modules:
CCM → SLO/SQO conversion workshop — Over three days, map 17 domains / 207 controls to SLO/SQO on whiteboards. "How many days for key rotation?" "4-hour or 8-hour incident notification SLO?" Management joins the judgment. Consultants do not decide for you.
Continuous Auditing API architecture review — Design conversion layers from existing metric pipelines (Datadog, CloudWatch, Splunk) to CCM format; decide tamper detection and API publication. Mentors with AWS Solutions Architect experience check technical feasibility.
Customer transparency dashboard mockups — Wireframes inspired by AWS Compliance Center and Microsoft Trust Center. Legal, sales, and security decide at one table how much to publish.
I treat Level 3 not as a security project but as organizational change. Continuous auditing means accepting 24/7 external visibility into security state. That resolve does not come from reading documents. Only from hands-on drills. That is WARP SECURITY's design philosophy.
Latest as of July 2026
Around continuous auditing, regulatory pressure is arriving with concrete dates. The general application date of the EU AI Act (Regulation (EU) 2024/1689) is August 2, 2026. What starts on that date is the transparency obligations (Article 50), the provisions on harmonised standards, conformity assessment, CE marking and registration (Articles 40–49), and the European Commission's power to impose fines on general-purpose AI (GPAI) providers (Article 101). The GPAI chapter (Chapter V) and the penalty provisions (Articles 99 and 100) have already applied since August 2, 2025.
A common misreading needs correcting here: August 2, 2026 is not the date when high-risk AI obligations fully apply. Under the amending Regulation (EU) 2026/1744 (adopted July 8, 2026; published as OJ L 2026/1744 on July 24, 2026; in force July 27, 2026), Chapter III Sections 1, 2 and 3 apply to Annex III high-risk AI (Article 6(2)) from December 2, 2027, and to Annex I high-risk AI (Article 6(1), embedded in products) from August 2, 2028. Article 22 (authorised representatives), Article 25 (value chain), Article 26 (deployer obligations) and Article 27 (fundamental rights impact assessment) take effect on the same schedule. The transitional regime for systems already placed on the market (Article 111(2)) was also changed to track the Chapter III application dates rather than a fixed date.
On sanctions: prohibited AI practices (Article 5) carry up to €35 million or 7% of worldwide turnover, and GPAI-related and other breaches up to €15 million or 3% of worldwide turnover, whichever is higher (Regulatory framework for AI (European Commission)). CSA STAR Level 3 itself remains unreleased as of July 2026, but as the EU moves AI governance into enforcement, the gap between providers that can produce continuous evidence and those that cannot will surface faster than previously expected. Domestically, AI operator guidelines and data-use rules continue to evolve; early mapping of that contour is continuous with continuous-audit prep (related: Personal Information Protection Act 2026 amendment).
Summary: not waiting is the optimal strategy
CSA STAR Level 3 is not formally released as of May 2026. That does not mean "do nothing." It means "move now and lead when it formalizes."
The three actions—internal SLO/SQO mapping, API prototypes, customer dashboards—each have standalone value. Even if Level 3 never ships, the investment is not wasted. The secondary effect of building a continuous-monitoring culture without waiting for Level 3 may matter more long term.
Related: CSA STAR Level 1 self-assessment, CSA STAR Level 2 third-party audit, ISO/IEC 27001 complete guide, ISO/IEC 42001 primer. Priority order for Japanese companies is in the master guide.
I have waited three years for Level 3 formalization. Honestly, I am tired of waiting. The direction of continuous auditing is still right. So as of May 2026, switch from "wait" to "prepare."
