What is the CAIQ?

The CAIQ (Consensus Assessments Initiative Questionnaire) is a standardized security questionnaire published by the Cloud Security Alliance (CSA). It asks a cloud service provider a structured set of yes-or-no questions, organized by control domain, so a customer or partner can evaluate the provider's security posture without writing a custom questionnaire from scratch. The current version, CAIQ v4, is built directly on the CSA's Cloud Controls Matrix (CCM), so each question maps back to a specific control in that matrix.

CSA also publishes CAIQ Lite, a shorter version aimed at smaller vendors and startups that need a lighter first step toward a full CAIQ response or a STAR Level 1 self-assessment.

A worked example

A startup selling to enterprise buyers gets asked to complete a CAIQ instead of the buyer's own custom security questionnaire. Because the CAIQ maps to the CCM, the startup can answer once against a control it already runs, such as encryption at rest, and reuse that same answer across every future CAIQ request instead of re-explaining the control from scratch every time a new prospect asks.

A common mistake

The most common mistake is treating each CAIQ response as a one-off form to fill out under deal pressure, instead of maintaining one canonical answer set tied to actual controls. Answers drift from what the environment actually does, a reviewer catches the inconsistency between one CAIQ response and another, and the mismatch itself becomes the flag, even when the underlying security posture is fine.

How it maps to an audit

The CAIQ is not an audit or a certification. It is a self-assessment that a buyer or partner uses as part of their own vendor due diligence. That said, the answers only hold up if they match what a SOC 2 or ISO 27001 audit would find, since a buyer that later requests your audit report will notice if the CAIQ and the report disagree. Keeping CAIQ answers current alongside your control evidence is what makes both hold together under scrutiny.

CAIQ requests usually show up in vendor security reviews. For help getting a blocked deal moving again, see security questionnaire help. For the reference standard the CAIQ is built on, see the SIG questionnaire, a related but separately-governed vendor questionnaire.