CAIQ
CAIQ questionnaire completion for cloud and SaaS providers
If a customer has asked for your CAIQ, we complete it from the security documentation you already hold. Each supported answer points to its source, anything unsupported comes back to you flagged, and you decide what is submitted.
What CAIQ is
The Cloud Security Alliance’s questionnaire for cloud providers.
The CAIQ (Consensus Assessments Initiative Questionnaire) is published by the Cloud Security Alliance (CSA). It asks cloud and SaaS providers to describe their security controls, and its questions are aligned to the CSA’s Cloud Controls Matrix (CCM). Answers are generally given as Yes, No or Not Applicable, often with a description of how the control is implemented.
Several versions exist, matched to different versions of the CCM. Your customer will tell you which one they want. We complete the version you were sent.
Worklyflow is not affiliated with the Cloud Security Alliance. We help you complete the CAIQ your customer asked for, from your own documentation.
When you receive one
A common alternative to a custom questionnaire.
Customers evaluating a SaaS or cloud service sometimes ask for a CAIQ instead of, or as well as, their own questionnaire, because it is a recognised format. Some ask you to make your CAIQ available through the CSA STAR Registry. Whether to do that is your decision. We prepare the answers for your review, and we don’t submit or publish anything on your behalf.
Why it takes time
It’s control-by-control, and it asks how.
- Questions follow the CCM’s control domains, so one topic in your policies can be asked about several times.
- Beyond Yes or No, the CAIQ typically wants a description of how a control is implemented.
- Recent versions may also ask about the split of responsibility between provider and customer.
- Controls that depend on your infrastructure provider need careful wording, so you don’t claim what isn’t yours to claim.
What to send
The CAIQ file and the documentation behind your answers.
The CAIQ as received
The original file and version, any instructions from your customer, and the deadline.
Security policies and procedures
Access control, logging, incident response, vulnerability management, change management and secure development.
Hosting and architecture documents
Where the service runs, which infrastructure providers you rely on, and how encryption and key management are handled.
Reports and prior answers
Any audit reports or certifications issued to you, and earlier CAIQ, SIG or DDQ responses you have approved.
How we complete it
The CAIQ workflow.
Confirm the CAIQ version
We check which version you were sent, and how much of it applies to your service.
Map each control question to your evidence
Questions are matched to the policies and technical documents that address them.
Draft answers and descriptions
Yes, No and Not Applicable responses, and implementation descriptions, are written only where your documentation supports them.
Flag unsupported controls
Where your documents are silent, partial or conflicting, or an answer depends on your cloud provider’s controls, we flag the question and note what you need to confirm.
You review and approve
You resolve the flagged items and approve the final answers before anything goes to your customer or anywhere else.
Reuse
One set of approved answers, several questionnaires.
The controls a CAIQ asks about also appear in a SIG and in most DDQs. Approved answers can be kept with their evidence and reused, once checked against your current documents. The complete service is described under security questionnaire completion. It is not an audit, certification or legal advice, and you approve every final answer.
Related
Related services
Request a questionnaire review
Asked to complete a CAIQ?
Tell us what you’ve received, its format and your deadline. We’ll review the scope and let you know what we need to complete it.