The CAIQ questionnaire explained: how to fill out the Cloud Security Alliance’s questionnaire

If a prospect sent you a spreadsheet full of control IDs like “IAM-02” and asked for a CAIQ, this guide is for you. The CAIQ is long, but it is predictable, and once it is done you can reuse it for every customer who asks.

What the CAIQ is

CAIQ stands for Consensus Assessment Initiative Questionnaire. It is published by the Cloud Security Alliance (CSA), a non-profit, and you can download it from the CSA website for free.

It is a spreadsheet of yes-or-no questions based on the CSA’s Cloud Controls Matrix (CCM), a framework of security controls for cloud services. The CCM says which controls should exist; the CAIQ asks whether you have them and how they work. Version 4.0 has 261 questions, down from 310 in version 3.1, so check which version your prospect sent.

Version 4 also added columns about the shared responsibility model: for each control, who is responsible, the cloud service provider (you) or the customer.

CAIQ and the STAR Registry

Cloud providers can publish a completed CAIQ on the CSA’s STAR Registry, which is known as STAR Level 1, a self-assessment. It is not a certification and doesn’t involve an auditor. Publishing is optional; many small companies simply send the completed file to the customer who asked for it.

How to complete it without a security team

1. Check the version and the tabs. Fill in the file you were sent rather than a newer copy from the website, so your answers line up with the customer’s tooling.
2. Work domain by domain. The questions are grouped (identity and access management, encryption and key management, logging, incident management, supply chain and so on). One person can usually answer a whole domain in one sitting with the right policy open.
3. Answer Yes or No literally. If a control is only partly in place, answer No (or the closest honest option) and explain in the comments what you do have.
4. Use the responsibility columns. Some controls are your hosting provider’s (physical data centre security) or your customer’s (managing their own users). Say so instead of answering Yes for someone else’s control.
5. Point to evidence. Name the policy or document that backs each answer, so a reviewer can check it.
6. Keep it. Save the completed CAIQ and your answers. The next customer who asks for a CAIQ gets it in minutes.

Common mistakes

• Answering Yes because your cloud provider has the control. Your provider’s certifications describe their controls, not yours.
• Leaving N/A without a reason. Add one sentence explaining why it doesn’t apply.
• Inconsistent answers between domains, for example access reviews described differently in two places.
• Treating a published CAIQ as a certification in sales conversations. It is a self-assessment, and reviewers know it.

For more on wording, see 10 answers that invite follow-up questions.

Answering a CAIQ with Rendro

Upload the CAIQ spreadsheet as you received it. Rendro finds the question and answer columns, drafts each answer only from your own documents with the source shown, flags the controls your documents don’t cover, and writes the answers back into the same file without touching its formulas or dropdowns. You can try it free for 14 days.