The key characteristic is on-demand self-service and not shelf" service.

It is false.
Customer will have to take permission and give notification to cloud service provider.
The cloud owner (public or private) will typically require notification of assessments and place limits on the nature of assessments. This is because they may be unable to distinguish an assessment from a real attack without prior warning.
Ref: CSA Security Guidelines V4.0

Transfer of cost of ownership is the key benefit of IaaS model.

"Technology Audit Program" is not one of the levels of CSA star program The three levels of CSA Star program are
1) Self Assessment
2) Third-party Attestment
3) Continuous Monitoring program

ISO 270017 provides guidance on the information security aspects of cloud computing. recommending and assisting with the implementation of cloud-specific information security controls supplementing the guidance in ISO/IEC 27002 and other ISO 27k standards.