What Is the CAIQ (Consensus Assessments Initiative Questionnaire)?

The Consensus Assessments Initiative Questionnaire (CAIQ) is a standardised self-assessment questionnaire from the Cloud Security Alliance (CSA) that cloud service providers complete to document the security and privacy controls they have in place — giving customers a consistent, comparable way to understand a provider's posture.

What the CAIQ is

The CAIQ is a structured questionnaire, historically answered yes/no with room for supporting detail, that a cloud provider fills in to describe its security controls. The whole point is standardisation. Before common questionnaires existed, every customer sent every provider its own bespoke list of security questions, and every provider answered each one differently — slow for buyers, exhausting for vendors, and impossible to compare. The CAIQ replaces that with one widely recognised set of questions, so a provider can answer once and many customers can read the same document.

CAIQ and the Cloud Controls Matrix

You cannot understand the CAIQ without the Cloud Controls Matrix (CCM), because the CAIQ is derived from it. The CCM is the control framework — a catalogue of cloud-security control objectives organised into domains covering areas such as identity and access management, encryption and key management, data security, application security, incident response, and supply-chain management. The CAIQ is the questionnaire built from that framework: for each CCM control, the CAIQ asks the questions that let a provider assert whether, and how, the control is implemented.

So the two work together: the CCM defines what good cloud security looks like, control by control, and the CAIQ captures a provider's claim about which of those controls it actually has. Because every CAIQ maps back to the same CCM, answers from different providers line up against the same reference, which is what makes them comparable. If you want deeper background on some of the control areas the CCM covers, our explainer on cryptography for security teams unpacks the encryption and key-management domain.

The STAR registry

Many providers publish their completed CAIQ on the CSA STAR registry — Security, Trust, Assurance and Risk — a public repository of cloud-provider security postures. STAR is tiered by assurance:

• Self-assessment. At the entry level, a provider completes and publishes its own CAIQ. It is transparent and useful, but self-attested — the customer is trusting the provider's own account.
• Third-party assessment and certification. Higher levels involve an independent assessor evaluating or certifying the provider against the CCM. These carry more weight because the controls have been externally validated rather than simply claimed.

The registry lets buyers find and compare documented postures in one place, and the assurance level tells them how much independent validation sits behind each entry — an important distinction when deciding how much follow-up diligence a given provider needs.

How the CAIQ is used in vendor assessment

In third-party and supply-chain risk management, a completed CAIQ is a pre-screen that saves everyone time. Rather than firing off a custom questionnaire and waiting weeks for a reply, a customer can pull the provider's CAIQ — from STAR or on request — and read its control posture against a framework they already know. That lets the assessing team do three things quickly: understand the baseline, spot the controls marked not implemented or not applicable, and focus their limited follow-up effort on those gaps and caveats rather than re-asking everything from scratch.

For low-risk engagements a current CAIQ may be most of what is needed. For higher-risk ones it is a starting point: a CAIQ is a self-attestation, so mature programmes treat it as a claim to be corroborated with evidence, certifications and their own testing rather than accepted at face value. The same discipline applies when you assess your own cloud footprint — tools like a CSPM readiness scorecard help you measure the posture a CAIQ merely asserts, and a structured application security verification approach brings the same rigour to the software layer.

CAIQ vs SIG

Because both are standardised assessment questionnaires, the CAIQ is often compared with the Shared Assessments SIG (Standardized Information Gathering) questionnaire. The key differences are scope and origin:

• CAIQ. From the CSA, cloud-specific, and tied directly to the Cloud Controls Matrix. It is the natural instrument for assessing a cloud service provider.
• SIG. From Shared Assessments, broader and highly configurable, covering many third-party-risk control areas beyond cloud — physical security, human resources, business continuity and more.

In practice many programmes use the SIG as their general vendor-risk questionnaire and accept or map a CAIQ for the cloud-specific portion. They are complementary instruments rather than direct competitors, and which one you meet depends on how the assessing organisation has built its programme.

The takeaway

The CAIQ is the CSA's standardised cloud-security self-assessment questionnaire, derived from the Cloud Controls Matrix and frequently published on the STAR registry. It lets cloud providers document their controls once, against a common framework, so customers can compare postures, pre-screen quickly and focus due diligence on the gaps. Treat a self-assessed CAIQ as a credible starting point to be verified, lean on higher STAR assurance levels where the stakes justify it, and remember it sits alongside broader instruments like the SIG in a complete third-party-risk programme.

Frequently asked questions

What is the CAIQ? The Consensus Assessments Initiative Questionnaire: a standardised CSA self-assessment questionnaire cloud providers complete to document their security and privacy controls in a consistent, comparable form.

How does it relate to the CCM? The Cloud Controls Matrix is the control framework; the CAIQ is the questionnaire derived from it, posing a question per CCM control so providers can assert whether and how each is implemented.

What is the STAR registry? The CSA Security, Trust, Assurance and Risk registry — a public repository of cloud-provider postures (often published CAIQs) with assurance levels from self-assessment up to third-party certification.

How is it used in vendor assessment? As a fast pre-screen: review a provider's CAIQ against a known framework, focus follow-up on gaps and caveats, and reduce bespoke questionnaires — corroborating with evidence for higher-risk engagements.

How does CAIQ differ from SIG? CAIQ is CSA, cloud-specific and tied to the CCM; the Shared Assessments SIG is broader and configurable, covering many third-party-risk areas beyond cloud. They are complementary.