The CAIQ is the Cloud Security Alliance's Consensus Assessments Initiative Questionnaire: a spreadsheet of yes or no questions about a cloud provider's security controls, built on the Cloud Controls Matrix. It is a self-assessment, not a certification. Ask for it when you want a standard, comparable answer set from a cloud vendor.
What the CAIQ is
According to the Cloud Security Alliance, the CAIQ is a downloadable spreadsheet of yes or no questions that map to the controls in the Cloud Controls Matrix (CCM). The CCM is a framework of cloud security practices, and each control is broken into concrete questions that show whether a provider follows it.
Cloud providers, whether infrastructure, platform or software, use it to document which controls their service has. Customers use it to judge whether the service is secure enough for their needs.
Versions and size
CSA states that CAIQ v4 has 261 questions, down from 310 in v3.1. It also publishes a condensed CAIQ-Lite with 124 questions that still covers all of the CCM control domains.
If a vendor offers you the Lite version, that is a reasonable starting point for a low-risk service. For anything that touches sensitive data, ask for the full set.
What it is not
The CAIQ is a self-assessment. Nobody independent has checked the answers. CSA says this directly: it is not a certification. A vendor can answer "yes" to every row and still run weak controls.
That does not make it useless. It does three jobs well:
- It gives you a common format, so you can compare two vendors line by line.
- It shows how the vendor describes shared responsibility, meaning what they do and what you must do.
- It gives you something specific to challenge when you ask for evidence.
How it connects to STAR
Providers can submit a completed CAIQ to the CSA STAR Registry, which is public. That earns STAR Level 1, a self-assessment level. Level 2 is separate and relies on an independent audit. Our post on STAR Level 1 and Level 2 covers the difference.
A public entry has a practical benefit. You can read it before you send anything, which saves your team and the vendor a round of back and forth.
When to ask for it
Ask for a CAIQ when:
- The vendor is a cloud service and holds your data or sits in your production path.
- You want something more structured than a free text security page.
- You need a baseline before deciding which vendors deserve a deeper review.
Skip it when the vendor is not a cloud service, or when you already hold a recent independent audit report that answers the same ground. Then spend your time reading the report, as described in how to read a vendor SOC 2 report.
Reviewing a returned CAIQ
Do not count the yeses. Read the comments column and look for rows marked "not applicable" without a reason. Pick five controls that matter most for your use case, such as encryption, access control and incident response, and ask for one piece of evidence for each.
If you use Safeguard, its compliance and evidence automation can keep the evidence you collect in one place next to your own controls. That is optional. A shared folder and a naming scheme also work.
Quick check
Is a CAIQ the same as a SOC 2 report?
No. A CAIQ is a vendor's own answers. A SOC 2 report is issued by an independent auditor after testing controls.
Do I need the full CAIQ or the Lite version?
Use Lite for low-risk services. Use the full questionnaire when the vendor handles sensitive data or runs something critical to you.
Sources
Last reviewed: 19 October 2026.
