CAIQ is the Cloud Security Alliance's free vendor questionnaire for cloud providers. The current version, CAIQ v4, has 261 yes/no questions that map one-to-one to the Cloud Controls Matrix v4 (197 controls across 17 cloud-security domains). It is the document AWS, Azure, and GCP all publish in the CSA STAR registry.
CAIQ (Consensus Assessments Initiative Questionnaire) is a free, open vendor questionnaire from the Cloud Security Alliance that lets a cloud provider document its security controls in a standardized form. CAIQ v4 has 261 questions, each mapped to a control in the Cloud Controls Matrix v4. Buyers use it as a cloud-specific complement to broader assessments like SIG.
What's in CAIQ v4?
CAIQ v4 is 261 yes/no questions across 17 cloud security domains, packaged as a downloadable spreadsheet from the Cloud Security Alliance.
The 17 domains in CCM v4 cover the working surface of a cloud-service operation: audit and assurance, application and interface security, business continuity, change control, cryptography and key management, data security, governance and risk, human resources, identity and access management, interoperability, infrastructure and virtualization, logging and monitoring, security incident management, supply chain, threat and vulnerability management, universal endpoint management, and one umbrella domain for cross-cutting controls. Each question takes a yes/no/NA answer plus a free-text explanation, with a column for any compensating control. There is also a CAIQ-Lite shortened version with 124 questions for quicker pre-screen reviews.
Is CAIQ free?
Yes. CAIQ is free to download, free to fill out, and free to publish in the STAR registry. No license fee, no per-seat charge, no membership.
This is unusual in the questionnaire world. The SIG from Shared Assessments requires a paid subscription if you want the full library and tooling. CAIQ sits on the CSA artifacts page as an Excel download, no gate. That alone explains why CAIQ adoption is broader than its question count suggests: the cost of starting is zero, and a completed CAIQ doubles as a public marketing asset once it lands in the STAR registry.
How is CAIQ different from SIG?
CAIQ is cloud-only and free; SIG is broader and paid. SIG covers HR, physical security, and operations on top of the cloud-specific control set.
The practitioner read: most teams send CAIQ as the cloud companion to SIG, not a replacement. A buyer doing diligence on a SaaS vendor running on AWS will often send a SIG (or SIG Lite) for the full operational picture and accept a published CAIQ for the cloud-control coverage. That split is why both documents keep showing up in the same procurement cycle. Here is the side-by-side.
| Dimension | CAIQ v4 | SIG Core (2025) | | ----------------- | ------------------------------ | --------------------------------------------------------- | | Scope | Cloud security only | Broad TPRM (cloud + HR + physical + operations + privacy) | | Question count | 261 | 627 | | Cost | Free | Paid subscription via Shared Assessments | | Home framework | Cloud Controls Matrix v4 | SIG Core mappings to NIST, ISO, PCI, HIPAA | | Format | Excel spreadsheet | Excel spreadsheet (with content library subscription) | | Audience | Cloud and SaaS reviews | General third-party risk programs | | Public publishing | Yes, via the CSA STAR registry | No public registry |
How does CAIQ map to the Cloud Controls Matrix?
Every CAIQ question is a yes/no rephrasing of a single CCM control. CAIQ is the assessment surface; CCM is the control library; they ship together.
CCM v4 was published in January 2021, expanding the previous version from 16 domains and 133 controls to 17 domains and 197 controls. The matrix also publishes mappings into ISO/IEC 27001, SOC 2 Trust Services Criteria, NIST 800-53, PCI DSS, and a handful of regional regulations. Filling out CAIQ honestly therefore gets you partial coverage of the answers you would owe a buyer asking about any of those frameworks. The mapping work is what makes CAIQ efficient in procurement: one document feeds many downstream review processes.
What is the STAR registry?
STAR is the CSA's public registry of cloud-provider security postures. Level 1 is a free CAIQ self-assessment; Level 2 adds a third-party audit.
STAR Level 1 is what most listed providers publish: a completed CAIQ v4 spreadsheet, freely downloadable, dated, and valid for one year from submission. AWS, Microsoft Azure, and Google Cloud Platform all maintain Level 1 entries, which is part of how procurement teams pre-fill cloud-supplier reviews. Level 2 is the audited tier; it requires a CSA-certified auditor and stacks on top of an existing ISO 27001 certification (STAR Certification, three-year validity) or SOC 2 attestation (STAR Attestation, one-year validity). Level 1 is a prerequisite for Level 2.
For most SaaS vendors, Level 2 is overkill. If you already hold a SOC 2 Type II and an ISO 27001 certificate, the marginal trust signal from STAR Attestation is small unless your buyers are heavily regulated cloud-first organizations actively asking for it. STAR Level 1, on the other hand, costs nothing beyond the time to fill it out, and it generates a public artifact you can point to in every sales cycle.
How does CAIQ relate to SOC 2 and ISO 27001?
CAIQ is self-attested. SOC 2 and ISO 27001 are third-party audits. The control sets overlap, but the artifacts and buyer trust signals differ.
A finished CAIQ carries roughly the trust weight of an attestation letter: it is the vendor's own answers, not an auditor's opinion. SOC 2, governed by the AICPA, produces a Type II report on operational effectiveness over a six- to twelve-month window. ISO 27001, maintained by ISO, is a certification that auditors renew on a three-year cycle. The CCM v4 mappings make CAIQ a useful pre-fill source for both: an honest CAIQ already sketches the answers an auditor will ask you to evidence. STAR Level 2 formalizes that link: it is literally an ISO 27001 or SOC 2 audit with the CCM controls bolted on.
How do buyers use CAIQ in procurement?
Buyers send CAIQ as the cloud-control assessment during pre-contract diligence, usually alongside a SIG, a SOC 2 review, and a pen-test summary.
The typical pattern we see: a procurement team requests a vendor security package with four artifacts. SOC 2 Type II report. ISO 27001 certificate (if applicable). A completed SIG Lite or SIG Core. A completed CAIQ v4 (or a STAR registry link). The CAIQ specifically answers questions about cloud-shared-responsibility boundaries, encryption-at-rest configurations, key management, IAM, and tenancy. Those are the questions a SIG asks at lower resolution. If you publish a STAR Level 1 entry, you can often satisfy the CAIQ ask with a one-line link in the response, which is why most cloud-native SaaS vendors maintain one. For more on the back-end of this work, see why questionnaires keep breaking sales cycles and the TPRM glossary entry.
Where does CAIQ-Lite fit?
CAIQ-Lite is a 124-question shortened version for early-stage vendor screens. Same 17 CCM domains, fewer questions per domain, faster turnaround.
Use CAIQ-Lite when a buyer is doing a quick triage rather than a full security review, or when the vendor is a low-criticality cloud tool (think a marketing analytics dashboard, not a payments processor). Most enterprise procurement teams will still want the full CAIQ for any vendor handling regulated data. The relationship is the same as SIG Core to SIG Lite: same framework, lower question depth, faster turnaround.
Frequently asked questions
These are the questions buyers and vendors ask most often when the CAIQ shows up in a procurement cycle for the first time.
What does CAIQ stand for?
CAIQ stands for Consensus Assessments Initiative Questionnaire. It is published by the Cloud Security Alliance as the assessment surface for the Cloud Controls Matrix.
How long does it take to fill out CAIQ v4?
In our customer base, first-time CAIQ submissions take roughly 20 to 40 hours across security and engineering owners. After the first pass, updates take a few hours per quarter as controls change. Most of the time goes to drafting the free-text explanations, not answering yes/no.
Is CAIQ a certification?
No. CAIQ is a self-assessment. STAR Level 1 publishes the self-assessment in a public registry, but no auditor signs it. STAR Level 2 is the certification tier, and it requires a separate ISO 27001 or SOC 2 audit.
Do AWS, Azure, and GCP publish CAIQs?
Yes. All three hyperscalers maintain entries in the CSA STAR registry and update their CAIQ submissions when underlying services change. SaaS vendors often link directly to the relevant hyperscaler CAIQ to answer infrastructure-layer questions about their own deployment.
Should we send CAIQ or SIG to our vendors?
If you are reviewing a cloud-only SaaS vendor and you want one questionnaire, SIG Lite plus a published CAIQ link covers more ground than either alone. If you want to standardize on one document, SIG Core is the broader tool but it costs money and your vendor may not have it ready. CAIQ is free and most cloud vendors already have it filled out.
How often is CAIQ updated?
CAIQ tracks the CCM release cycle. CCM v4 launched in January 2021; the current CCM v4.1 is published as a combined CCM-and-CAIQ artifact with 197 control objectives across 17 domains. Practical advice: refresh your CAIQ submission annually, and re-baseline whenever a CCM minor version ships.
For the matching glossary entry, see CAIQ. For more on the broader vendor-questionnaire stack, see the SIG questionnaire guide and the SOC 2 questionnaire checklist.