CAIQ-Lite: The Lighter-weight Security Assessment Option

CSA’s Consensus Assessment Initiative Questionnaire (CAIQ) is a downloadable spreadsheet of yes or no questions that correspond to the controls of the Cloud Controls Matrix (CCM), our cybersecurity controls framework for cloud computing. A cloud service provider can use the CAIQ to document what security controls exist in their services.

The CSA Security Update podcast is hosted by John DiMaria, CSA Assurance Investigatory Fellow, and explores the STAR Program, CSA best practices, research, and associated technologies and tools. This blog is part of a series where we edit key CSA Security Update episodes into shorter Q&As. In today’s post, John interviews Nick Sorenson, CEO of Whistic. He discusses the research and statistical analysis that went into the creation of CAIQ-Lite, a shorter and condensed version of CAIQ, along with use cases of how and when it should be used.

Listen to the full podcast here.

---

The Origins of CAIQ-Lite

John DiMaria: Our guest today is Nick Sorenson, CEO of Whistic, who partnered with CSA to develop CAIQ-Lite. To start off, can you explain the original business case behind how CAIQ-Lite was born and how it ties into CAIQ itself?

Nick Sorenson: So the idea for a lighter version of CAIQ didn’t originate from Whistic, but had been around amongst CSA members and in conversations with Jim Reavis, CEO and founder of CSA, for years. I was sharing feedback that our customers provided about CAIQ and the laborious nature of working through 295 questions, and he shared the concept of simplifying this to be more manageable.

JD: So with CAIQ-Lite being a shorter version of CAIQ, there’s always concerns about a shorter version of something that had typically been longer in the past. To be transparent, what type of research went into the validation of the final product?

NS: First off, the outcome of the research resulted in every one of the original 16 control domains from CAIQ to be represented in CAIQ-Lite. CSA had actually already done internal research that was shared amongst members to devise different versions of CAIQ-Lite. Additionally, we at Whistic, as a vendor security company, have customers that assess their vendors from which we wanted their feedback. Lastly, we put together a research panel of 600+ IT security professionals and ran them through statistical analysis to determine which questions in CAIQ were most relevant when conducting vendor assessments.

Why CAIQ-Lite?

JD: So the paper on CAIQ-Lite that CSA and Whistic co-authored notes that while increasing the security baseline, there is a risk of overburdening cloud providers with questions not commensurate with their level of risk. So with the fact that data today is being compromised at an alarming rate, should the overburdening of cloud service providers be a concern? What’s the balance that ensures CAIQ-Lite provides an adequate level of confidence?

NS: Ultimately, each organization must determine how they leverage the CAIQ-Lite and what specific use cases and risk appetite they have at their organization. However, it actually is a burden on both sides: the vendor has to answer 295 questions versus 73, and the assessor performing the assessment also has that added burden. Overburdening the vendor reflects directly on the company as well.

If your vendors are willing to do CAIQ, do the whole thing. That’s what we recommend. But what we're seeing more often is that organizations don’t have the time to assess all low-risk vendors, and instead want to focus only on high-risk. The ideal middle ground is CAIQ-Lite. Instead of passing by low-risk vendors, you now have a shorter avenue in CAIQ-Lite.

CAIQ and Submitting to STAR

JD: In your experience, what would you say to cloud service providers about the importance of submitting CAIQ to the STAR Registry?

NS: We recommend to any cloud service provider to start with the STAR Registry. It makes no sense to respond to a questionnaire without first self-publishing to STAR and aligning with CSA CAIQ. The industry is going towards a model where it’s going to be expected from purchasers buying cloud services that you would publish your information in the future.

Maybe 90% of vendor risk management exchange could be classified as administrative burden - referring to the back and forth of tracking down information. The concept of the STAR Registry and self-publishing cuts through to raising the bar on security and improving the industry. Putting tools like CAIQ-Lite in the hands of cloud service providers and companies, making things easier, is at the heart of Whistic’s mission of helping companies hold each other more accountable.

JD: Really appreciate you coming on today, thanks again Nick.

---

Click here for more information regarding STAR certification and the different levels of STAR.

Click here to learn more about CAIQ and how it relates to STAR and the CCM.