Answering the CAIQ v4.1 for the first time: a small SaaS guide

On 28 January 2026 the Cloud Security Alliance released version 4.1 of the Cloud Controls Matrix (CCM) and the matching Consensus Assessments Initiative Questionnaire (CAIQ). If an enterprise buyer has just emailed you a spreadsheet with "CAIQ" in the filename, this is the version you will most likely see, or its predecessor, v4.0.

The CAIQ looks intimidating because it is long. It is also one of the most reusable questionnaires you will ever fill in, because every question maps to a published control. Answer it carefully once and you can reuse the work for years.

What's affected

The CAIQ is the questionnaire form of the CCM, CSA's cloud security control framework. According to CSA's transition notice, CCM v4.1 added 11 new control specifications and removed one IAM control. CAIQ v4.1 has 283 questions. The v4.0.2 edition it replaces had 261 questions across 17 domains, and v4 introduced Shared Security Responsibility Model (SSRM) sections where a cloud provider describes who implements each control, the provider or the customer.

CSA's published timeline matters if a buyer sends you an older file:

If a customer sends a v4.0 file, answer that file. Do not reformat it into v4.1 unless they ask. If you plan to publish to the STAR Registry, use v4.1 so you do not redo the work later.

How to check if you're ready to answer

Before you open the spreadsheet, check that you can answer these five things in one sentence each. Most CAIQ domains collapse into them.

1. Where does customer data live (cloud provider, regions, backups)?
2. Who can reach production, and how is that access granted and removed?
3. How are changes reviewed and released?
4. How do you find and fix vulnerabilities, and how fast?
5. What happens in the first 24 hours of an incident?

If any answer is "it depends who you ask", fix that first. Questionnaire answers that contradict each other across your team are what slow deals down, not the questions themselves.

Next, set up a plain answer library, one row per CCM control ID. A minimal layout:

control_id | question_summary | answer (Yes/No/NA) | one-paragraph explanation | evidence file | owner | last_reviewed
IAM-xx     | MFA for admin access | Yes | Enforced by the identity provider for all staff | idp-mfa-policy.png, 2026-09 export | CTO | 2026-10-01

Keep explanations to one paragraph and name a real artifact for each Yes. A Yes with no artifact behind it is the answer that causes trouble in a follow-up call.

What to do now

1. Ask the buyer which version and which file they want completed, and whether they accept a link to a public STAR entry instead.
2. Read the whole sheet once before answering. Mark questions that are really about the cloud host (shared responsibility) and answer those by stating what your provider covers and what you cover.
3. Answer Yes only where a control is in place and evidenced today. Use No with a short plan note for gaps, and NA only when the control cannot apply to your service.
4. Write explanations in plain sentences. "We use SSO with enforced MFA for all staff accounts, reviewed quarterly" beats a paragraph of policy language.
5. Have a second person, ideally an engineer, check every Yes against reality.
6. Save the finished file and the library. The next questionnaire, in any format, will overlap with it heavily. Count how many answers you reuse each time, so you can see the library paying off.
7. Decide about STAR Level 1. CSA describes it as a self-assessment that providers can list in a free, public registry, and describes it as a way to reduce the number of customer questionnaires. Level 2 adds an outside audit and comes as a STAR Attestation based on SOC 2 or a STAR Certification based on ISO/IEC 27001.

How to avoid this trap

The trap is treating each questionnaire as a one-off. The cheaper path:

• Build the answer library the first time, keyed to control IDs, and review it twice a year.
• Keep evidence in one folder named by control, so a Yes can be backed in minutes.
• Do not copy a competitor's public answers or paste marketing text. A buyer may compare the CAIQ to your SOC 2 report or your website, and mismatches get noticed.
• Never answer for infrastructure you do not control. If your cloud host runs the data center, say so and name the shared responsibility.
• Version your answers. When a buyer asks "what changed since last year", you want a diff, not a memory.

Why it matters

A questionnaire is a sales document with legal weight. A Yes in a signed response can be quoted back to you in a contract dispute or after an incident. That is the real reason to be exact, and it is why short, true answers beat long, optimistic ones.

CSA's own framing helps here: the STAR program is built so providers can publish their posture once and send buyers to it. For a small company that gets the same request every month, a public Level 1 entry can turn a two-day task into a link. It is still a self-assessment, so buyers who want independent assurance will ask for more.

Try it yourself

Pick one CAIQ domain, for example Identity and Access Management, and fill in your answer library rows for it in 30 minutes. Note which Yes answers you cannot back with a file. Those are your real gaps.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CSA: CCM v4.1 transition timeline (19 February 2026)
• CSA: STAR program
• CSA: CAIQ v4 announcement