CAIQ (Consensus Assessments Initiative Questionnaire) is the Cloud Security Alliance's yes/no questionnaire that lets a cloud customer or auditor confirm a provider's controls map to the Cloud Controls Matrix. The current v4 has 261 questions, down from 310 in v3.1. It is the artifact a provider files for STAR Level 1 self-assessment.
What does the current CAIQ v4 actually contain?
CAIQ v4 has 261 yes/no questions organized one-to-one against the Cloud Controls Matrix v4, with a Shared Responsibility Model column added to v4.
The 261 questions sit across 17 CCM v4 control domains covering identity, encryption, business continuity, supply-chain transparency, and others (CSA). For a lighter screen, CAIQ-Lite trims the count to 124 questions while keeping coverage of every CCM domain.
How does CAIQ relate to the CSA STAR program?
CAIQ is the questionnaire a provider files for STAR Level 1, the free self-assessment tier of the CSA Security Trust Assurance Risk registry.
STAR Level 2 layers a third-party audit on top, usually combined with ISO 27001 plus ISO 27017 or with a SOC 2 Type 2 (CSA). Most cloud-native vendors we see post a STAR Level 1 CAIQ before they have audit budget for Level 2.
Why does CAIQ keep showing up alongside SIG in vendor reviews?
Because cloud-heavy buyers want a CCM-shaped answer, and CAIQ is the only common questionnaire that maps directly to cloud-specific controls.
Most teams running a TPRM intake send the SIG by default and add CAIQ when the vendor is IaaS, PaaS, or a multi-tenant SaaS with shared infrastructure. Posting both on a public trust page cuts inbound questionnaire volume noticeably.
Related terms
These adjacent terms cover the control catalog, the trust registry, and the questionnaire alternatives buyers compare CAIQ against in a vendor review.
- Cloud Controls Matrix - the 197-control catalog CAIQ maps one-to-one against
- CSA STAR - the registry where CAIQ submissions live as Level 1 entries
- SIG - Shared Assessments' broader questionnaire that often pairs with CAIQ
- SOC 2 - the audit report a STAR Level 2 submission usually attaches