CAIQ (Consensus Assessments Initiative Questionnaire)
CAIQ is a cloud security questionnaire developed by the Cloud Security Alliance (CSA) to evaluate cloud service providers against the CSA Cloud Controls Matrix.
Definition
The Consensus Assessment Initiative Questionnaire (CAIQ) is a cloud security self-assessment questionnaire published by the Cloud Security Alliance. CAIQ questions accompany and map to the Cloud Controls Matrix (CCM); CAIQ v4.1 includes a STAR Level 1 submission version as well as reference material.
Context
CAIQ helps cloud providers explain how their controls address CCM requirements. Respondents should identify the CAIQ/CCM release, distinguish the reference questionnaire from the STAR submission version, preserve control mappings, and support each answer with current, scoped evidence.
Why it matters
Use the publisher's current release package rather than a copied question-count summary. CSA's v4.1 package includes the CCM, CAIQ material, implementation guidance, change analysis, and machine-readable mappings.
Cloud answers often require engineering, security, privacy, and resilience context. Keep inherited cloud-provider controls separate from vendor-managed controls and state the product, region, deployment, and shared-responsibility scope that each response covers.
A completed CAIQ is a self-assessment input, not independent proof that every control is effective. Buyers may combine it with audit reports, certification material, technical review, contract terms, interviews, or other due diligence.
Reviewed primary sources
The definition above distinguishes the current publishers and artifacts using these primary sources.