What Is a CAIQ Questionnaire and How Do You Complete One?

# What Is a CAIQ and How Do You Complete One?

Written by Tijana Zunic, Attorney at Law specialising in IT Law, Data Protection, and AI Law. She holds an LL.M from the University of Cambridge and has been recognised as a Global & Thought Leader in Data Privacy & Protection by Who's Who Legal from 2020 through 2026. Described by Legal 500 as 'solution oriented, responsive and pragmatic', she advises multinational companies and leading IT organisations on data privacy compliance, AI governance, cybersecurity frameworks, and regulatory risk.

Reviewed by Nikola Maric, Software and AI Engineer. Published: March 2026 | Next review: September 2026

There is a moment in almost every cloud SaaS sales cycle that experienced sales engineers learn to dread: the deal is progressing, the champion is engaged, and then procurement sends over a spreadsheet. Hundreds of rows. Column after column of security and compliance questions, each one expecting a precise, defensible answer. Increasingly, that spreadsheet is the CAIQ.

The Consensus Assessments Initiative Questionnaire (CAIQ) functions like passport control for cloud vendors. Instead of every buyer designing their own security intake form, the Cloud Security Alliance built a single, standardised checkpoint. One framework. One question set. One structure. If your product runs in the cloud, processes customer data, or plugs into enterprise environments, you will encounter a CAIQ. Not might. Will.

What makes the CAIQ different from a bespoke vendor questionnaire is its direct mapping to the Cloud Controls Matrix (CCM), a globally recognised framework of roughly 200 cloud security control specifications. Each CAIQ question asks something deceptively simple: do you have this control in place, and can you prove it? The answers, however, require specificity that catches many first-time respondents off guard.

The good news is that the CAIQ is learnable. Once you understand the architecture behind the questions, the whole thing starts to make sense as a system rather than an obstacle. This guide walks through that system end to end. For the broader picture of how the CAIQ fits into your vendor assessment programme, see our guide on security questionnaire automation.

What Is the CAIQ?

The Cloud Security Alliance (CSA) is a global non-profit whose membership includes major cloud providers, financial institutions, technology companies, and government agencies. The CAIQ is their standardised self-assessment tool, and understanding why it exists helps you understand how to answer it well.

Here is the analogy that works best: if cloud security were a building, the CCM would be the architectural blueprint. The CAIQ is the inspection checklist used to verify that the building was actually constructed to spec. The CCM defines approximately 200 control specifications spread across 17 security domains. The CAIQ takes each one and turns it into a structured disclosure question.

For buyers, the value is comparability. They can evaluate five vendors using the exact same exam rather than five different interviews with five different scopes. For vendors, the value is predictability. Learn the framework once. Prepare your evidence once. Then reuse it, buyer after buyer, without starting over each time.

CAIQ vs SIG: Two Lenses, Same Objective

Vendors who receive multiple questionnaire types frequently ask whether the CAIQ replaces the SIG questionnaire. It does not. The two frameworks are better understood as different lenses focused on the same subject, cloud and vendor security, but from different angles and at different magnifications.

In practice, large enterprises often use both. The SIG tells them about the organisation as a whole: governance, HR security, physical controls, the full picture. The CAIQ zooms in specifically on cloud architecture and technical controls. What matters for vendors is this: the evidence you prepare, your policies, certifications, and architecture documentation, is reusable across both frameworks. The questions are different. The underlying proof is the same.

What the CAIQ Actually Covers: Thinking in Domains

Seventeen domains. That sounds like a lot, and it is, but each one maps to something concrete in your organisation. Rather than treating these as abstract compliance categories, think of them as systems in a machine, each performing a distinct function. When one of those systems has a gap, the CAIQ is designed to find it.

Viewed this way, answering the CAIQ is less about filling out a form and more about describing how your entire system operates. Each domain is a component. Your completed CAIQ is the full schematic.

Who Sends the CAIQ and Why?

The buyers who send CAIQs tend to have one thing in common: they have been doing cloud vendor assessments long enough to want a standardised process. Designing custom questionnaires for every vendor in a portfolio of fifty or a hundred is not sustainable. The CAIQ gives them a consistent filter.

The common senders:

• Cloud-native enterprises aligning their vendor portfolio with their own infrastructure and governance standards
• Financial institutions and fintechs conducting third-party risk assessments under DORA, SOC requirements, or internal cloud risk policy
• Healthcare organisations assessing cloud vendors before granting access to patient data or clinical systems
• Technology companies running scalable vendor due diligence programmes that require a comparable, repeatable format
• Government agencies and regulated entities whose procurement frameworks reference CSA standards

Many of these organisations also check the CSA STAR registry, a public directory of vendor security profiles, before sending a formal CAIQ at all. If your completed assessment is already published there, some buyers will simply pull it. No formal request. No back-and-forth. The assessment effectively happens before you know about it.

How to Complete the CAIQ: Step by Step

A CAIQ is a coordination exercise, not a writing exercise. The teams that finish fastest are the ones that route questions to the right people immediately rather than trying to answer everything sequentially. For organisations that receive CAIQs regularly, security questionnaire automation pre-populates most responses from your live compliance documentation before anyone needs to engage. But the process below is the foundation either way.

Step 1: Assign ownership by domain

Do not start answering. Start routing. IAM, TVM, and LOG go to your CISO or security engineer. DSP and the privacy-adjacent parts of GRC go to your DPO or legal counsel. AIS goes to your engineering lead. BCR and IVS go to your infrastructure or DevOps team. STA goes to whoever manages your vendor and subprocessor relationships.

Send every section out at the same time. Parallel completion is the single most effective way to compress response time, and it requires nothing more than a routing table and a deadline.

Step 2: Lead with certifications, not explanations

This is where many teams waste hours they do not need to. If you hold a current SOC 2 Type II report, it covers the majority of controls in AIS, BCR, CCC, IAM, LOG, SEF, and TVM. An ISO 27001 certificate covers GRC, HRS, IAM, DCS, and CEK. Where you have a certification, do not write a paragraph explaining your control. Answer Yes and cite the report: "See attached SOC 2 Type II report, Section 3." One reference replaces dozens of explanations. Use the leverage you have already paid for.

Step 3: Be precise about your cloud architecture

Vague answers kill credibility with sophisticated buyers. And the buyers sending CAIQs are, by definition, sophisticated. Several domains, IVS, DCS, CEK, and LOG in particular, demand specificity about your infrastructure. Not "we use a major cloud provider." Not "data is encrypted." They want to know which cloud provider, which region, what encryption standard, how network isolation is implemented.

"AWS us-east-1 with VPC isolation and AES-256 encryption at rest" is a complete answer. "Data is stored securely in the cloud" is not. Buyers with mature risk programmes will cross-reference your architecture claims against your certifications and prior assessments. Be precise.

Step 4: Handle DSP and STA with particular care

These two domains require original, precise answers more often than others. Why? Because they reflect real-world data handling and actual third-party dependencies rather than architectural decisions you made once and documented. DSP questions must align with your actual data flows, prepared from your GDPR documentation and Records of Processing Activities. STA questions must reflect your current subprocessor list, not the one from last year.

If most other domains are about structure, DSP and STA are about reality. Any gap between what you write and what actually happens gets detected quickly.

Step 5: Mark N/A controls accurately

Not Applicable is a valid answer. It is not evasion; it is accuracy. A fully cloud-native SaaS vendor with no on-premises infrastructure will legitimately mark many DCS controls as N/A because physical datacenter security belongs to the cloud provider, not to you. Explain why. If a control applies but is not implemented yet, answer No with a remediation timeline and a brief justification.

Transparency is not a weakness here. A No with a credible plan reads better than a Yes that unravels when someone checks.

Step 6: Treat your completed CAIQ as a reusable asset

The first CAIQ is the hardest. It should also be the last time you build one from zero. Save the approved version and load it into your security questionnaire response library. When the next buyer sends a CAIQ, automated matching against that library can pre-populate 80-90% of responses before a human reviewer looks at it. The upfront investment pays dividends every time a new request arrives, and for growing SaaS companies, they arrive with increasing frequency.

Certifications as Shortcuts Through the CAIQ

The principle is simple: certifications convert narrative answers into references. Instead of writing 200 individual control explanations, you cite systems that have already been independently verified. The time savings are substantial, and the credibility is higher because the evidence comes from an auditor, not from you.

A vendor holding both SOC 2 Type II and ISO 27001 can complete the bulk of a CAIQ by reference alone. The original narrative answers become necessary only for the residual questions those frameworks do not directly cover, which in practice is a manageable subset.

The CAIQ, GDPR, and Data Privacy Compliance

The questionnaire burden in numbers: According to the Cloud Security Alliance's 2024 Cloud Adoption and Risk Report, 72% of enterprise organisations now require a formal vendor security assessment before granting cloud vendors access to production data or systems (CSA, 2024). The CAIQ, at approximately 200 structured controls, is manageable by that standard, but only if you show up prepared rather than improvising.

The DSP domain maps directly to the obligations that GDPR Article 28 imposes on data processors. If you process personal data for your customers, this is not a procurement formality. Your CAIQ responses in DSP are legal representations about your compliance posture. Your customers will rely on them to demonstrate their own regulatory compliance. Get something wrong here and the problem cascades.

Prepare this section from your live GDPR documentation: your Data Processing Agreement template, your Records of Processing Activities, and any DPIA summaries for high-risk processing activities. Where CCPA compliance is also relevant, that documentation addresses the questions US-based buyers typically layer on top.

The CSA STAR Registry: One Submission, Many Benefits

Publishing your CAIQ in the CSA STAR registry is like posting your credentials in a public directory that buyers check before they even contact you. The most efficient CAIQ is the one you never have to fill out again because the buyer already found it.

Three levels of assurance:

• STAR Level 1 (Self-Assessment): Submit your completed CAIQ for public access. No third-party audit required. This is the right starting point for most SaaS vendors.
• STAR Level 2 (Third-Party Audit): Your CAIQ responses are validated by an independent auditor, typically aligned with SOC 2 or ISO 27001 certification.
• STAR Level 3 (Continuous Monitoring): The highest assurance tier, involving continuous automated assessment of your cloud controls.

For most B2B SaaS companies, Level 1 is the right move. Combine a published STAR entry with a Trust Center where your certifications, policies, and DPA are also available on demand, and you have created a self-service security profile that works around the clock. Buyers who find you through either channel can get what they need without sending a formal questionnaire. The 4.8-hour assessment that never arrives is the most efficient one you will ever produce.

The CAIQ and the EU AI Act in 2026

The GRC domain is where AI governance questions are starting to appear. EU-based buyers, or any organisation with exposure to the EU AI Act (Regulation (EU) 2024/1689), are beginning to ask cloud vendors about AI system inventories, risk classification approaches, and human oversight mechanisms. These questions sit at the intersection of cloud security and AI governance, and they catch vendors off guard if they have not thought about this overlap before.

If your product involves AI, this section is only going to grow. Vendors who have already formalised their AI governance through ISO 42001 certification or a structured EU AI Act readiness programme will handle these questions in minutes. Those who have not will find themselves building responses under deadline pressure, and the results tend to show it. The most cost-effective approach is building an AI governance section into your response library now, starting with a free AI inventory template, before these controls become standard across all CAIQ assessments.

A Final Perspective

The CAIQ can feel overwhelming the first time you open it. Two hundred questions. Seventeen domains. A spreadsheet that seems designed to expose every gap in your security programme simultaneously.

But here is what experienced teams discover: the CAIQ is not testing new information. It is asking you to organise and present what already exists. Your architecture. Your policies. Your controls. Most of the answers are already living in documents your team has already produced.

Once you see that, the CAIQ shifts from an obstacle to a tool. A way to demonstrate maturity, build buyer trust, and accelerate enterprise deals. Completing a CAIQ is less about answering questions and more about telling a coherent story of how your system was designed to be secure. Clarity beats complexity every time.

Whisperly extracts every question from your CAIQ, matches it against your live compliance documentation, SOC 2, ISO 27001, GDPR records, and ISO 42001, and generates confidence-rated draft answers before your team needs to engage. What used to take 10 hours takes a fraction of that.

Book a demo | Explore RFP and questionnaire automation | Launch your free Trust Center

Frequently Asked Questions

What does CAIQ stand for?

Consensus Assessments Initiative Questionnaire. Published by the Cloud Security Alliance, mapped to the Cloud Controls Matrix, covering approximately 200 security control specifications across 17 domains. The "consensus" in the name is not marketing language; it reflects the framework's origins as a collaborative effort among CSA member organisations, not a standard imposed by any single company or regulator.

How long does it take to complete a CAIQ?

First time through, without an existing evidence library, expect 4-10 hours of combined effort across multiple team members. The Yes/No/NA format moves faster than a narrative questionnaire like the SIG, but the justification fields still demand precision, particularly in DSP, IAM, and TVM where a vague answer is worse than no answer.

With a well-maintained response library and current SOC 2 and ISO 27001 certifications backing it up, repeat completions drop to 1-3 hours. Mostly review, not creation.

Is the CAIQ mandatory?

Technically, no. It is a voluntary self-assessment. Nobody is compelled to fill one out. Practically, though, for cloud-native SaaS vendors selling into regulated industries, declining to complete a CAIQ when a buyer requests one sends exactly the wrong signal. It does not communicate that you are too busy. It communicates that you might have something to hide.

What is the difference between the CAIQ and the CSA STAR registry?

The CAIQ is the document. You fill it out. The STAR registry is the public database where completed CAIQs are published so any buyer can access them. Submitting your CAIQ to the registry at STAR Level 1 means you stop sending it individually to each buyer who asks. They find it themselves.

Do I need SOC 2 to complete a CAIQ?

Not technically. But a current SOC 2 Type II report dramatically reduces the work. SOC 2 provides independently audited evidence for the majority of CAIQ control domains, which means you can answer those controls by reference rather than writing an original justification each time. Without it, every control in AIS, IAM, LOG, SEF, and TVM requires a narrative explanation that a buyer's risk team has to evaluate on trust. That is a harder sell.

How does the CAIQ relate to ISO 27001?

Both are controls-based frameworks addressing information security management. An ISO 27001 certificate provides audited evidence covering GRC, HRS, IAM, DCS, and CEK domains. It does not replace the CAIQ itself, you still need to submit the completed questionnaire, but it simplifies those domains substantially because the work has already been verified by an independent auditor.

Can I reuse a completed CAIQ for multiple buyers?

Yes. Your controls, certifications, and architecture remain valid across multiple assessments for as long as those controls are in place. The smartest approach is loading your approved responses into a security questionnaire automation platform so each new CAIQ request auto-populates from your library. Human review focuses only on buyer-specific deviations or newly added controls.

What should I do if I cannot answer a CAIQ control affirmatively?

Answer No. Then explain. Is this a deliberate architectural decision? A known accepted risk? A remediation currently in progress with a target completion date? Buyers running mature risk programmes can work with any of those answers. What they cannot work with is a Yes that turns out to be false six months later during an audit. That kills deals and damages relationships in ways that are very difficult to repair. Honest gaps start conversations. Inflated claims end them.

Related Whisperly Guides

For general tips that apply across frameworks, see our security questionnaire best practices.