Draft your CSA CAIQ answers, domain by domain
Pick the Cloud Controls Matrix domains, describe your controls, and get structured CAIQ-style answers with SSRM ownership, weak answers flagged before a customer flags them, and a CSV to work from.
Pick CCM domains
4 of 17 picked. Start with the domains your customers ask about most.
Describe your controls
Each domain starts with an example description. Replace it with what you actually do.
CEK · Cryptography, Encryption & Key ManagementEncryption in transit and at rest, key generation, rotation, storage and revocation.
Assessors typically ask for: Crypto standard, KMS configuration, key rotation records.
IAM · Identity & Access ManagementAccount lifecycle, least privilege, strong authentication, privileged access and access reviews.
Assessors typically ask for: Access policy, MFA configuration, quarterly access review records.
LOG · Logging & MonitoringSecurity event logging, protection and retention of logs, monitoring and alerting.
Assessors typically ask for: Logging standard, SIEM coverage, retention settings, alert runbooks.
TVM · Threat & Vulnerability ManagementVulnerability scanning, patching timelines, threat intelligence and penetration testing.
Assessors typically ask for: Scan reports, patch SLA, pen-test summary, remediation records.
Draft quality
Domain-level drafts. Paste each into the matching question rows of the official CAIQ from CSA, and adjust per question.
CEK · Cryptography, Encryption & Key Management
Needs workCEK Cryptography, Encryption & Key Management Answer: Yes | SSRM ownership: CSP-owned Implementation description: Data is encrypted at rest with AES-256 using keys in a cloud KMS, rotated annually. Traffic is encrypted in transit with TLS 1.2 or higher. Key administration is limited to two named roles and logged. Evidence available on request: Written policy; Records showing it operates
- Still the example text. Replace it with what your service actually does; a CAIQ is a statement customers rely on.
IAM · Identity & Access Management
Needs workIAM Identity & Access Management Answer: Yes | SSRM ownership: Shared CSP and CSC Implementation description: Workforce access uses SSO with phishing-resistant MFA. Production access is role-based, granted by ticket with manager approval, and reviewed quarterly. Privileged access is just-in-time and logged. Customer (CSC) responsibilities: Customers manage their own users, roles and MFA settings within their tenant. Evidence available on request: Written policy; Records showing it operates
- Still the example text. Replace it with what your service actually does; a CAIQ is a statement customers rely on.
LOG · Logging & Monitoring
Needs workLOG Logging & Monitoring Answer: Yes | SSRM ownership: CSP-owned Implementation description: Security-relevant events from cloud, identity and application layers are sent to a central SIEM in a separate account, retained for 12 months on immutable storage, and monitored with alerts routed to on-call. Evidence available on request: Written policy; Records showing it operates
- Still the example text. Replace it with what your service actually does; a CAIQ is a statement customers rely on.
TVM · Threat & Vulnerability Management
Needs workTVM Threat & Vulnerability Management Answer: Yes | SSRM ownership: CSP-owned Implementation description: Infrastructure and dependencies are scanned continuously. Critical vulnerabilities (CVSS 9.0+ or listed in CISA KEV) are remediated within 7 days and high within 30 days; exceptions require documented risk acceptance. Evidence available on request: Written policy; Records showing it operates
- Still the example text. Replace it with what your service actually does; a CAIQ is a statement customers rely on.
Loading…
TL;DRThe short answer
5 points
- The CAIQ (Consensus Assessments Initiative Questionnaire) is the Cloud Security Alliance questionnaire built on the Cloud Controls Matrix (CCM). Providers answer it to describe their security controls, often publishing it on the CSA STAR Registry.
- The CCM has 17 domains. CCM v4.1 (January 2026) lists 207 controls, and CSA now publishes the CCM and CAIQ combined.
- Since CAIQ v4, each answer needs more than Yes/No/NA: a Shared Security Responsibility Model (SSRM) ownership choice, and optionally a description of how the provider implements the control and what the customer must do.
- The weak answers reviewers chase are predictable: a bare Yes, an NA on a domain that applies to every cloud service, a No with no plan, shared ownership with no customer responsibilities, and vague wording like "industry standard".
- This tool drafts domain-level answers. Download the official CAIQ from CSA and paste the drafts into the matching question rows.
The 17 CCM domains, in plain words
Domain names and IDs as published by CSA; summaries and evidence notes are ours, not CSA text. For background, read What is CAIQ?
How weak answers are flagged
Each draft is checked against rules that mirror what reviewers chase: a Yes with fewer than a dozen words or no evidence; evidence that is only a policy; no frequency or timeline; no named mechanism in technical domains (crypto, identity, logging, vulnerabilities, testing, audit); vague phrases such as "industry standard" or "periodically"; an NA with no reason, or on a domain that applies to almost every cloud service; a No with no plan; and customer-involved ownership with no customer responsibilities. These are PlayCISO's rules, not CSA scoring.
To use the drafts: download the current CAIQ from CSA (the CCM v4.1 download includes it), find the question rows for each domain, and adapt the domain draft to each question. A domain-level answer is a starting point; individual questions often ask about one specific part of the domain.
Frequently asked questions
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire is the Cloud Security Alliance's standard questionnaire for cloud providers, derived from the Cloud Controls Matrix (CCM). A provider answers it once to describe its controls, and customers can read the same document instead of sending their own questionnaires. Many providers publish theirs on the CSA STAR Registry as a Level 1 self-assessment.
How many questions are in the CAIQ?
CSA reported that CAIQ v4 cut the question count from 310 in v3.1 to 261. CSA released CCM v4.1 in January 2026 with the CCM and CAIQ combined, and publishes a change analysis listing which questions changed from v4.0.3. Check the version your customer asks for.
What are the CCM domains?
The 17 CCM domains are Audit & Assurance (A&A), Application & Interface Security (AIS), Business Continuity Management & Operational Resilience (BCR), Change Control & Configuration Management (CCC), Cryptography, Encryption & Key Management (CEK), Datacenter Security (DCS), Data Security & Privacy (DSP), Governance, Risk Management & Compliance (GRC), Human Resources Security (HRS), Identity & Access Management (IAM), Interoperability & Portability (IPY), Infrastructure & Virtualization Security (IVS), Logging & Monitoring (LOG), Security Incident Management, E-Discovery & Cloud Forensics (SEF), Supply Chain Management, Transparency & Accountability (STA), Threat & Vulnerability Management (TVM) and Universal Endpoint Management (UEM).
What is SSRM control ownership in the CAIQ?
Since CAIQ v4, each answer records who owns the control under the Shared Security Responsibility Model. CSA defines five options: CSP-owned, CSC-owned (the customer), 3rd-party outsourced, Shared CSP and CSC, and Shared CSP and 3rd party. Where the customer shares ownership, say what the customer must do.
When is it OK to answer NA?
When the control genuinely does not apply to the service being assessed, with a short reason. Some domains apply to almost every cloud service (identity, logging, vulnerability management, incident response), so an NA there usually draws follow-up. A control your hosting provider runs is usually a Yes with third-party ownership, backed by its audit report, rather than an NA.
Does this tool include the official CAIQ questions?
No. The CCM and CAIQ are published by the Cloud Security Alliance, and this tool does not reproduce the question set. It lists the domain names and IDs with our own summaries, helps you draft one structured answer per domain, and exports a CSV. Download the official CAIQ from CSA and adapt each draft to the individual questions.
Sources
- Cloud Security Alliance: Cloud Controls Matrix (CCM) (read 31 Oct 2026). The CCM is a cybersecurity control framework for cloud computing in 17 domains. CSA states that with version 4.1 the CCM and CAIQ are combined, and describes the CAIQ as a set of yes/no questions for assessing cloud providers.
- Cloud Security Alliance: Cloud Controls Matrix v4.1 (download) (27 Jan 2026). CCM v4.1 has 207 controls across 17 security domains. CSA also publishes a change analysis from CAIQ v4.0.3 to v4.1 identifying changed assessment questions.
- Cloud Security Alliance: CAIQ v4 released: changes from v3.1 to v4 (7 Jun 2021). CAIQ v4 cut the question count from 310 to 261 and added a mandatory Shared Security Responsibility Model (SSRM) ownership column with five options (CSP-owned, CSC-owned, 3rd-party outsourced, Shared CSP and CSC, Shared CSP and 3rd party), plus optional columns describing the provider's implementation and the customer's responsibilities. Ownership ties to control STA-04.
- Cloud Security Alliance: STAR Registry (read 31 Oct 2026). Providers publish completed CAIQs as STAR Level 1 self-assessments; higher STAR levels add third-party assessment or certification.
CCM, CAIQ and STAR are Cloud Security Alliance publications and programmes. PlayCISO is not affiliated with or endorsed by CSA. Answers must be true for your service; a CAIQ is a statement customers rely on.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.