Consensus Assessments

Latest ResearchJoin Group
Consensus Assessment Initiative Questionnaire (CAIQ) v3.1
Consensus Assessment Initiative Questionnaire (CAIQ) v3.1

Download

Provide feedback on the new version of CAIQ v4
Consensus Assessments
Lack of security control transparency is a leading inhibitor to the adoption of cloud services. The CSA Consensus Assessments (CAIQ) working group was launched to perform research, create tools and create industry partnerships to enable cloud computing assessments. 

The CAIQ is used by CSPs to submit to the CSA STAR Registry.

The Consensus Assessments Initiative Questionnaire (CAIQ) v3.1. offers an industry-accepted way to document which security controls exist in IaaS, PaaS, and SaaS services, providing security control transparency. It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM). It helps cloud customers to gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure. The CAIQ is used by CSPs to submit to the CSA STAR Registry.

This working group has merged with the CCM working group

Consensus AssessmentsEnterprise ArchitectureCloud Component SpecificationsSecurity GuidanceCloud Controls MatrixCCAKSTAR

This group is focused on providing industry-accepted ways to provide security control transparency by documenting which security controls exist. This group has been merged with the CCM working group.

Next Meeting

No Meetings Currently Scheduled



Working Group Leadership

Laura Posey Headshot

Laura Posey

Sean Cordero Headshot

Sean Cordero

Evelyn de Souza Headshot

Evelyn de Souza

Submit to the STAR Registry!

Cloud Security Research for Vendor Assessments

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

Consensus Assessment Initiative Questionnaire (CAIQ) v3.1

Consensus Assessment Initiative Questionnaire (CAIQ) v3.1

The Consensus Assessments Initiative Questionnaire provides 295 Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM). This version of CAIQ improves the semantics of unclear questions for corresponding CCM v3.0.1 controls. In total, 49 new questions were added, and 25 existing ones were revised.  

CAIQ-Lite

CAIQ-Lite

CSA and Whistic identified the need for a lighter-weight assessment questionnaire in order to accommodate the shift to cloud procurement models, and to enable cybersecurity professionals to more easily engage with cloud vendors. CAIQ-Lite was developed to meet the demands of an increasingly fast-paced cybersecurity environment where adoption is becoming paramount when selecting a vendor security questionnaire. CAIQ-Lite contains 71 questions compared to the 295 found in the CAIQ, while maintaining representation of 100% of the original 16 control domains present in the Cloud Controls Matrix (CCM) 3.0.1.

CAIQ Translation in 10 Languages

CAIQ Translation in 10 Languages

CSA in the context of an agreement with OneTrust has translated the Consensus Assessments Initiative Questionnaire (CAIQ) v3.0.1 in 10 languages in order to facilitate their easier adoption by organizations at the corresponding countries. Provided translations are in the following languages: Spanish (ES), German (DE), French (FR), Italian (IT), Japanese (JA), Danish (DA), Dutch (NL), Portuguese (PT), Romanian (RO) and Swedish (SV).

Blog Posts

CCM v4 FAQ - Transition Timeline
​Vendor Management Software Evaluation: How to Get Executive Buy-In
The Right Questions to Ask Your Vendors in Times of Large-Scale Remote Working