Valid-AI-ted Scorer: Scoring Rubric

Cloud Security AllianceSTAR Valid-AI-ted

The scorer evaluates the quality and internal consistency of written answers, not independent implementation evidence.

Question score scale

ScoreMeaning
0Invalid, empty, failed or major contradiction
1Weak or minimal
2Basic or partial; ceiling for “No” answers
3Strong; meets expectations
4Excellent; exceeds expectations

Mechanical checks

Required implementation descriptions that are blank, only 1–2 ASCII characters, or merely “yes”/“no” automatically score 0. Required descriptions depend on ownership. A mechanical failure skips AI scoring.

SSRM Control Ownership is mandatory and must be one of the valid ownership values for the questionnaire type; a missing or invalid value automatically scores 0. Exception: when the answer is “NA”, a blank ownership is acceptable and is not scored.

Yes, No and NA

“Yes” may score 0–4. “No” caps all row scores at 2. “NA” may reach 4 with adequate justification and remains in averages. Major contradictions can score 0.

Qualitative scoring

Each row is evaluated using implementation explanations, responsibilities, ownership, guideline alignment and contradictions. The overall row score is holistic, not a fixed weighted formula. Readability feedback does not alter numeric scores.

Consolidating results

Domain average = sum of question scores ÷ number of questions, including NA rows. Domain percentage = average ÷ 4 × 100. Overall percentage is the unweighted mean of all row scores ÷ 4 × 100, not an equal-weight average of domains. Question PASS is ≥2; domain and overall PASS is ≥50%.

Worked example: 4, 3, 2, 1 → average 2.5/4 → 62.5% → domain PASS. Three questions score ≥2; one scores below 2.
Important: A domain consisting entirely of well-explained “No” answers can receive 50% and PASS. This is not a statement that controls are implemented, compliant or independently verified.

Release 1.1.0 supports CCM 4.0.13/4.1.0 and AICM 1.0.2/1.1.0. The framework version must be confirmed before scoring.

Support: support@cloudsecurityalliance.org

© 2026 Cloud Security Alliance. All rights reserved.

Informational AI-assisted questionnaire assessment only; not a CSA certification, audit, attestation, STAR Registry listing or badge.