What is CAIQ?

Blog Article Published: 09/01/2021

CCM, STAR, CCSK, CCAK – the Cloud Security Alliance is rolling in acronyms that you might not be familiar with yet. In this post, we’re going to get you up to speed on one of our most useful tools for cloud security transparency: the CAIQ.

A Questionnaire for Transparency and Assurance

CAIQ is an acronym for the Consensus Assessment Initiative Questionnaire. This questionnaire is a downloadable spreadsheet of yes or no questions that correspond to the controls of CSA’s Cloud Controls Matrix (CCM), our cybersecurity controls framework for cloud computing. An IaaS, PaaS, or SaaS cloud service provider (CSP) can use the CAIQ to document what security controls exist in their services. This increases security control transparency for potential customers, who can then determine if the CSP’s cloud services are secure enough for the customer’s purposes.

CAIQ vs. CCM

The CAIQ and the CCM are two CSA resources that are very closely tied. As stated previously, the CCM is a cloud security controls framework, or list of best practices. These best practices come from CSA’s Security Guidance for Cloud Computing. The CCM provides guidance on cloud security implementation for both providers and customers, and outlines which security controls should be implemented by which actor within the cloud supply chain.

The questions on the CAIQ are based on the best practices listed in the CCM. These questions break up each CCM control into clear actions that indicate whether a CSP is adhering to that control. Therefore, the CAIQ is best used for documentation and auditing.

CAIQ and STAR

CSPs can also submit the CAIQ to the CSA STAR Registry, our cloud security assurance program, to earn STAR Level 1. When a CAIQ is posted on the STAR public registry and updated on a regular basis, cloud customers can easily monitor a provider’s ongoing compliance postures. This also encourages due diligence on the part of the CSP and leads to a higher quality procurement experience.

One common misconception is that the CAIQ itself is a certification. This is not true – CAIQ is a questionnaire in the form of a spreadsheet, which the STAR program uses as a self-assessment for CSPs to document compliance. However, CSA does have a separate STAR certification for CSP organizations, which is a requirement for STAR Level 2.

Read this blog post to learn more about why cloud providers should consider submitting a CAIQ, and why cloud customers should require their cloud providers to submit one.

Introducing CAIQ v4.0

CAIQ v4 includes new features that are expected to increase the value for its users - both cloud service providers and customers. These features include:

  • 261 questions instead of the 310 found in v3.1
  • Structural changes that offer the user the possibility to show additional accountability and transparency about their security and privacy practices
  • Columns about the Shared Responsibility Model

Learn more about CAIQ v4 in this blog.

CAIQ-Lite

CAIQ-Lite is a shorter and condensed version of CAIQ that allows cloud customers to more easily engage with their service providers. CAIQ-Lite contains 71 questions compared to the 261 found in the CAIQ, while still addressing all 16 of the CCM’s control domains. This is a great option for a fast-paced cloud provider environment that isn’t suited to a more thorough questionnaire like the CAIQ.

The CAIQ-Lite can be accessed by CSA members for free on our website as well as from our industry partner Whistic.


Download CAIQ v4 here or visit the Consensus Assessments Working Group page to learn more about CSA research for vendor assessments.

Share this content on your favorite social network today!