What Is the CAIQ?
The CAIQ (Consensus Assessment Initiative Questionnaire) is the Cloud Security Alliance's standardized questionnaire for evaluating cloud provider security. Part of the CSA STAR program, it covers 16 control domains and ~260 questions.
CSA STAR Levels
- Level 1 — Self-Assessment: fill out the CAIQ and publish on the CSA registry. Free.
- Level 2 — Third-Party Audit: combined with ISO 27001 or SOC 2.
- Level 3 — Continuous Monitoring.
The 16 Control Domains
Audit & Assurance, Application Security, Business Continuity, Change Control, Cryptography, Datacenter Security, Data Privacy, GRC, HR Security, IAM, Interoperability, Infrastructure Security, Logging, Incident Management, Supply Chain, Threat Management.
Automate Your Security Questionnaires
Compli.st answers your ISO 27001, SOC 2 and GDPR questionnaires in minutes using AI.
Try for FreeAnswer in 1 Hour: The Method
Preparation (15 min)
Download CAIQ v4, gather documents, upload to Compli.st.
AI Fill (30 min)
Import CAIQ, AI proposes sourced answers, flags gaps.
Review (15 min)
Review flagged items, adjust context-specific answers, export.
CAIQ ↔ ISO/SOC 2 Mapping
If you're already ISO 27001 or SOC 2, 70-80% of the CAIQ is already covered.