.jpg)
.avif)
- The Cloud Security Alliance CAIQ (Consensus Assessment Initiative Questionnaire) is a standard set of yes, no and not applicable questions mapped to CSA's Cloud Controls Matrix.
- CAIQ v4.1, released in January 2026, has 283 questions across 17 CCM domains. CAIQ v4.0 had 261 and v3.1 had 310.
- STAR accepts v4.0 and v4.1 until December 2027, then only v4.1. CCM and CAIQ v4.0.x are withdrawn in January 2028.
- CAIQ Lite is a shorter version for smaller firms. Only the full CAIQ is submitted for a STAR Level 1 listing, which is free.
- The guide gives vendors a 6-step process for answering the CAIQ and covers the AI-CAIQ and how CAIQ compares with SIG, VSA and HECVAT.
- SiftHub is an AI RFP software that drafts security questionnaire answers from approved content, with sources and SME review.
- The Cloud Security Alliance CAIQ (Consensus Assessment Initiative Questionnaire) is a standard set of yes, no and not applicable questions mapped to CSA's Cloud Controls Matrix.
- CAIQ v4.1, released in January 2026, has 283 questions across 17 CCM domains. CAIQ v4.0 had 261 and v3.1 had 310.
- STAR accepts v4.0 and v4.1 until December 2027, then only v4.1. CCM and CAIQ v4.0.x are withdrawn in January 2028.
- CAIQ Lite is a shorter version for smaller firms. Only the full CAIQ is submitted for a STAR Level 1 listing, which is free.
- The guide gives vendors a 6-step process for answering the CAIQ and covers the AI-CAIQ and how CAIQ compares with SIG, VSA and HECVAT.
- SiftHub is an AI RFP software that drafts security questionnaire answers from approved content, with sources and SME review.
Your buyer's security team sends a short email. "Can you share your CAIQ, or a link to your STAR listing?" If you sell cloud or SaaS software, you will likely see this request. The Cloud Security Alliance CAIQ questionnaire is a standard cloud security questionnaire that SaaS buyers often ask for during security review.
The Cloud Security Alliance CAIQ questionnaire, short for Consensus Assessment Initiative Questionnaire, is a standard set of yes, no and not applicable questions mapped to CSA's Cloud Controls Matrix. Cloud and SaaS vendors fill it in to show buyers which security controls they run. The current version, CAIQ v4.1, has 283 questions.
Buyers lean on standard questionnaires for a reason. Third parties were involved in 48% of breaches in Verizon's 2026 Data Breach Investigations Report. A cloud security assessment questionnaire like the CAIQ gives them one consistent way to check every cloud vendor.
This guide is written for the vendor side: presales, solutions engineers and the security or GRC owner who signs off on the answers.
In this guide:
- What is the CAIQ questionnaire?
- How does the CAIQ relate to the Cloud Controls Matrix?
- What changed in CAIQ v4.1?
- What is CAIQ Lite?
- What does a CAIQ assessment look like?
- How to answer the CAIQ as a vendor
- How do you publish your CAIQ to the STAR Registry?
- What is the AI-CAIQ?
- How is the CAIQ different from SIG, VSA and HECVAT?
- How can you speed up CAIQ responses?
What is the CAIQ questionnaire (Consensus Assessment Initiative Questionnaire)?
The CAIQ questionnaire is a question set that checks whether a cloud provider runs the controls in the Cloud Controls Matrix (CCM). CSA describes it as "a downloadable spreadsheet of yes or no questions that correspond to the controls of" the CCM, in its explainer What is CAIQ? Each question breaks one control into a specific action, so a reviewer can see whether you do it.
So what is CAIQ in practice? It gives buyers and vendors a shared format. A buyer can ask for one known document, and a vendor can answer it once and reuse it across deals.
A few facts that help when a buyer asks about it:
- Who publishes it. The Cloud Security Alliance. CSA announced the first Consensus Assessment Initiative Questionnaire on October 12, 2010.
- Who sends it. Buyers who are assessing cloud and SaaS vendors.
- Who fills it in. The vendor, called the cloud service provider (CSP) in CAIQ terms.
- What it is not. It is not a certification. A completed CAIQ is a self-assessment. Third-party assurance sits at STAR Level 2, covered below.
If you already answer custom security questionnaires, much of the CAIQ will feel familiar. Our guide to the information security questionnaire covers the common question themes.
How does the CAIQ relate to the Cloud Controls Matrix?
The CCM is the control framework. The CAIQ is the question set that tests it. When CSA updates the CCM, the CAIQ changes with it.
CCM v4.1 has 207 controls in 17 domains, per CSA's CCM v4.1 release post. Every CAIQ question belongs to one of these domains.
[Image placeholder: The 17 Cloud Controls Matrix v4.1 domains that the CAIQ questionnaire covers]
CCM v4.1 also ships with mappings to NIST 800-171 rev.2, MITRE ATT&CK v17.1 and DORA. It comes in machine-readable JSON, YAML and OSCAL versions too, according to the CCM v4.1 artifact page. For vendors, the mappings matter more than they look. If a buyer also asks about NIST or DORA, the same control evidence can answer much of both, once you check where the mappings leave gaps.
What changed in CAIQ v4.1?
CSA released CCM v4.1 and CAIQ v4.1 in January 2026. CAIQ v4.1 has 283 questions. That is up from 261 in v4.0, and down from 310 in v3.1.
The new control specifications sit in five domains: Datacenter Security, Logging and Monitoring, Security Incident Management, Supply Chain, and Threat and Vulnerability Management. If your CAIQ v4 answers are a few years old, start with those sections, then re-check the rest. Existing controls were revised too.
One detail trips people up. The CCM v4.1 bundle includes a reference CAIQ, but that copy cannot be submitted to the STAR Registry. CSA publishes a separate "STAR Level 1 Security Questionnaire" file for submission. Use that one.
CSA has also set a transition timeline:
- From March 2026, STAR Levels 1 and 2 accept both v4.0 and v4.1.
- From December 2027, STAR accepts only v4.1.
- In January 2028, CCM and CAIQ v4.0.x are withdrawn.
CSA also gives services already listed on v4.0 a transition period. Even so, if you have a CAIQ v4 on file today, plan the v4.1 update well before December 2027.
What is CAIQ Lite, and when should you use it?
CAIQ Lite is a shorter questionnaire built from the full CAIQ. CSA still offers it, and its v4.1 release notes list CAIQ-Lite updates alongside the new CCM. CSA positions CCM Lite and CAIQ Lite for small and medium businesses and startups, as "an initial step towards" a full Level 1 self-assessment.
How long is CAIQ Lite? In the v4.0 era it had 124 questions, per CSA. CSA has not published a question count for the v4.1 Lite version yet, so treat any other figure you see online with care.
If you are not sure, ask the buyer which version they accept. Sending Lite when a reviewer expected the full CAIQ costs you a round trip.
What does a CAIQ assessment look like?
A CAIQ assessment is a spreadsheet. Each row is one question tied to a CCM control. Since v4, each row has more than a yes or no box.
[Image placeholder: CAIQ questionnaire answer columns: response, SSRM ownership, implementation description]
Per CSA's Introductory Guidance to CCM, the main answer columns are:
- Response. Yes, No or NA.
- SSRM Control Ownership. Who owns the control under the shared security responsibility model.
- CSP Implementation Description. How you, the provider, run the control.
- CSC Responsibilities. What the customer must do. This column is optional, but CSA recommends it.
CSA's current guidance names three main ownership types. Here is what each one means in practice:
- CSP-owned. You run the control. Example: your secure development process and the vulnerability scanning of your own application code.
- CSC-owned. The customer runs it. Example: deciding which of their own employees get access to your product.
- Shared. Both sides have a part. Example: you provide single sign-on support, and the customer configures it and enforces it for their users.
The v4.0 template also had options for controls run by a third party, such as datacenter physical security run by your cloud host. Check which options your version of the sheet offers.
This is where CAIQ answers often get weak. A "Yes" with a blank implementation description tells a reviewer very little. Some questions are also broad enough that a short answer cannot cover them, and policy documents rarely map cleanly onto individual questions. Expect to write real explanations.
How to answer the CAIQ questionnaire as a vendor
Many teams treat the CAIQ as a one-off fire drill. It works better as a document you build once and keep current. One practitioner on Hacker News put it simply: pick a standard like the CAIQ and keep an always up-to-date version of it.
1. Confirm the version, scope and format
Before anyone writes an answer, settle four things:
- Full CAIQ or CAIQ-Lite.
- v4.0 or v4.1. STAR accepts v4.0 until December 2027, but new submissions are better on v4.1.
- Which product or service the answers cover.
- Whether the buyer wants their own spreadsheet back or will accept a link to your STAR listing.
2. Start from what you already have
Pull together your SOC 2 report, ISO 27001 certificate, any previous CAIQ, security policies and trust center content. Many CAIQ answers already exist somewhere in these documents. The work is finding them and rewriting them for the question in front of you.
If you answer security questionnaires often, it pays to reuse security questionnaire responses from a single library rather than from old spreadsheets.
3. Assign each domain an owner
Map the 17 domains to the people who run those controls. Identity and Access Management goes to IT or security. Human Resources goes to people ops. Supply Chain may go to legal or procurement.
Keep presales or solutions engineering as the coordinator. The coordinator chases answers and keeps the file moving. That way a senior engineer is not pulled in to answer every line.
4. Write implementation descriptions from how controls run
Describe what actually happens, not what the policy says should happen. Name the tool, the frequency and the owner where you can. "Access reviews run quarterly in our identity provider, owned by IT" beats "Access is reviewed periodically per policy."
Vague answers slow reviews down. They trigger follow-up questions, and follow-up questions add days.
5. Answer "No" and "NA" honestly
An all-"Yes" CAIQ can read as over-claimed. Worse, a "Yes" that falls apart in due diligence costs you trust you will not get back in that deal.
When the honest answer is "No," say so. Then add a compensating control or a planned date. When the answer is "NA," explain why the control does not apply to your service. A one-line reason saves a follow-up email.
6. Review, then save the final answers
Have someone from security review the full file before it goes out. Check that answers match your SOC 2 report and your trust center. Mismatches are easy for reviewers to spot.
Then save the final answers in one place. The next CAIQ, the next custom questionnaire and the next vendor due diligence questionnaire will reuse much of them.
How do you publish your CAIQ to the CSA STAR Registry?
The CSA STAR Registry is a public list of cloud providers and their security documents. Publishing your CAIQ there lets buyers find it without asking you. Large providers such as AWS and Oracle publish completed CAIQs, and Atlassian maintains STAR Registry submissions for its major cloud services.
STAR Level 1 is the self-assessment level. Based on CSA's STAR self-assessment page, the process looks like this:
- Download the standalone STAR Level 1 Security Questionnaire (the CAIQ). Do not submit the CCM bundle copy.
- Answer every question, and fill in the ownership and implementation columns.
- Submit it to CSA through the STAR program.
- Update it every year.
The standard Level 1 submission is free. CSA calls it "a complimentary offering."
CSA also offers optional AI scoring of your submission, called Valid-AI-ted. It costs $595 for up to 10 scoring attempts and is free for CSA Corporate Members, per the STAR levels page. A passing score adds a badge to your registry listing.
When should you move to Level 2? STAR Level 2 adds a third-party audit:
- STAR Attestation builds on a SOC 2 audit and lasts one year.
- STAR Certification builds on ISO/IEC 27001 and lasts three years.
If you already hold SOC 2 or ISO 27001, Level 2 builds on that audit by adding the CCM controls to its scope. Ask your auditor what the extra scope involves.
One caveat. A STAR listing will not stop every questionnaire, because many buyers still send their own form out of policy.
Offer the STAR link first. If they still need their form, reuse your CAIQ answers to fill it.
What is the AI-CAIQ?
The AI-CAIQ is CSA's questionnaire for AI services. It sits under STAR for AI, which builds on the AI Controls Matrix (AICM), the AI-CAIQ and ISO/IEC 42001.
According to CSA's AICM v1.1 announcement, AICM v1.1 has 247 control objectives in 18 domains. It is a superset of CCM v4.1 and adds a Model Security domain. The AI-CAIQ has 320 questions.
The levels mirror standard STAR:
- Level 1 is an AI-CAIQ self-assessment.
- Level 2, since November 20, 2025, is a Valid-AI-ted AI-CAIQ plus ISO/IEC 42001 certification.
Who gets the AI-CAIQ? Vendors with AI features in the product. If your product uses AI, some buyers may ask for it alongside the standard CAIQ.
How is the CAIQ different from other cloud security questionnaires?
The Cloud Security Alliance CAIQ questionnaire is one of four standard questionnaires vendors often receive. It is the one built for cloud services, and the only one of these four with a CSA-run public registry.
The others are SIG, VSA and HECVAT. Each comes from a different body and fits a different buyer. If a buyer sends you a cloud security questionnaire, it is usually one of these or a custom form built from them.
[Image placeholder: Cloud Security Alliance CAIQ questionnaire compared with SIG, VSA and HECVAT]
Sources: CSA STAR, Shared Assessments, the Vendor Security Alliance and EDUCAUSE.
The answers overlap heavily. Encryption, access control, incident response and vendor management show up in all four. One master answer set covers much of each. Our guide to the SIG questionnaire goes deeper on that format.
How can you speed up CAIQ responses?
Even with good habits, a 283-question CAIQ takes real time. A few approaches help, and each has limits:
- A spreadsheet answer library. Cheap and common. It breaks down when answers live in several copies and nobody knows which is current.
- A public STAR listing and trust center. A strong way to answer before anyone asks. It does not help with the custom questionnaires that still arrive.
- A GRC platform. Strong for monitoring controls and collecting audit evidence. Some include questionnaire features, usually tied to their own control data.
- AI RFP software. Drafts answers from your approved content. It only works as well as the content behind it.
SiftHub is an AI RFP software that automates RFP, RFI, DDQ, and security questionnaire responses for B2B SaaS presales, solutions engineering, and bid teams. For a CAIQ, that looks like this:
- Answers fill straight into the spreadsheet in Excel or Google Sheets, so you keep one file.
- Every answer cites its source document and version, with an audit trail of who reviewed or edited it.
- When it cannot find a high-confidence answer, SiftHub says "no answer found" instead of guessing.
- Open questions go to an assigned subject matter expert for review, and only reviewed answers go back into the library.
- SiftHub auto-fills up to 80% of answers on the first pass, depending on how complete your approved content is.
See how SiftHub fills security questionnaires from your approved content.
[Screenshot placeholder, real SiftHub product screenshot only: SiftHub showing a security questionnaire answer with its source document]
For a wider view of the category, read our guides on security questionnaire automation and AI tools for security questionnaire management. You can also see an example trust center on our security and compliance page.
The short version
The Cloud Security Alliance CAIQ questionnaire is a standard cloud security questionnaire in SaaS deals. Know which version the buyer wants, and start from your SOC 2 and existing answers.
Write implementation descriptions from how your controls actually run. Then publish to the STAR Registry so buyers can find it, and update it before the December 2027 v4.1 cutoff.
