The CAIQ, or Consensus Assessments Initiative Questionnaire, is a set of yes or no questions from the Cloud Security Alliance that a cloud customer can ask a cloud provider about its security controls. Fill it in with answers you can back with evidence, and use the comment column to explain anything that is not a clean yes.
What it is
The Cloud Security Alliance describes the CAIQ as an industry accepted way to document which security controls exist in infrastructure, platform and software as a service offerings. The questions are yes or no questions a cloud customer and a cloud auditor may wish to ask a provider to see how it lines up with the Cloud Controls Matrix, known as the CCM. The CSA says the latest version has been combined with the CCM, and that providers use the CAIQ and CCM when submitting to the CSA STAR Registry.
Check the CSA page for the current version before you start, because the versions and the transition timeline have changed.
Why yes or no questions are hard
Real controls are rarely binary. You may have multi factor authentication for staff but not yet for a legacy admin tool. A forced yes overclaims and a forced no understates. The comment field is where the honest answer lives.
An answer pattern for each question
| Your situation | Answer | Comment to add |
|---|---|---|
| Control operates everywhere | Yes | One line on how, plus an evidence reference |
| Control operates in part | Yes or No, whichever is more accurate | State the scope and the gap |
| Control planned | No | Planned date and owner |
| Control belongs to your cloud provider | Not applicable or shared | Say who is responsible |
| Not relevant to your service | Not applicable | Say why |
Steps to complete it
- Download the current version from the CSA and confirm what version your customer expects.
- Assign every domain to an owner. Engineering, people operations and legal own different sections.
- Pull answers from your existing answer library first, so you do not contradict earlier replies.
- For every yes, attach or cite one piece of evidence, such as a policy, a configuration export or a test record.
- Have a second person check a sample of answers against the evidence.
- Record the completion date and the approver.
Things that go wrong
- Copying last year's file. Controls change. Review every row.
- Answering for the cloud provider's controls as if they were yours. Use a shared responsibility note.
- Marking compliant with a framework you only mapped against. The CAIQ maps to a control matrix, but filling it in is a self assessment. It is not an audit and not a certification.
Be explicit about that last point in your cover note. Say "self assessment completed on this date by this team", and do not describe the file as an attestation.
Reuse
If a customer sends their own form, you can often pull answers from a completed CAIQ, and the reverse. Keep one answer library and treat the CAIQ as one view of it. When a customer challenges an answer, the evidence reference lets you respond in minutes.
Where Safeguard fits
Safeguard's framework mapping and compliance automation can link one piece of evidence to several controls, which reduces rework when a second questionnaire arrives. You can see the idea in the demo below.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how a single evidence item maps to more than one framework requirement.
Quick check
Is completing a CAIQ the same as being certified?
No. It is a self assessment that documents your controls. State it that way.
Can we answer not applicable to avoid a no?
Only if the control is truly out of scope for your service. Say why in the comment.
Sources
Last reviewed: 19 October 2026.
