CAIQ questionnaire automation

What is the CAIQ?

The CAIQ (Consensus Assessments Initiative Questionnaire) is a security questionnaire published by the Cloud Security Alliance (CSA). It turns the CSA's Cloud Controls Matrix (CCM) into yes/no questions a cloud or SaaS provider answers about itself.

• The CCM v4 has 197 control objectives in 17 domains, such as Identity & Access Management, Logging and Monitoring, and Cryptography.
• CAIQ v4.0 asks 261 questions about those controls. Each one is answered Yes, No or NA, with who owns the control and an optional written explanation.
• CSA released version 4.1 in January 2026. It has 283 questions, and the STAR Registry accepts both v4.0 and v4.1 until December 2027.

Buyers send the CAIQ as an Excel file during security review. Providers also publish completed ones on the CSA STAR Registry as a self-assessment.

Why it's slow to fill

The questions are short. Answering them well is not.

• Every answer needs proof. A Yes means "we do this." A careful reviewer will ask where your policy says so.
• Many questions bundle several claims. "Established, documented, approved, communicated, applied, evaluated and maintained" is one question. Some add "at least annually" or "all systems", and those parts need their own proof.
• The same topic shows up many times. Access reviews, logging and encryption come back across several domains, so answers must agree with each other.
• Gaps are easy to paper over. Under time pressure, it is tempting to answer Yes and move on. That is the answer that gets you into trouble later.

How Citesheet fills a CAIQ

1. Add your documents. Your policies as PDF, Word or Markdown. They are the only source of answers.
2. Add the CAIQ you were sent. The Excel file, as it is.
3. Get the same file back, filled. Same layout, same dropdowns. Each answer has a quote and the document it came from.

What happens to each question:

• Answered. The value (Yes / No / NA) and an explanation, backed by a quote. Code checks that the quote exists word for word in your document. If it doesn't, the answer is not written.
• Needs review. Your documents support part of the question, or two documents disagree. The row has a "Check:" line saying why, so you know what to look at.
• No proof found. Nothing in your documents supports an answer. The row stays empty and goes on a gap list, so you can decide whether to write the policy or answer it yourself.

Your questions, layout and dropdowns are not changed. Before the file goes back to you, we check that nothing outside the answer cells changed. A re-run never overwrites an answer you edited.

What we measured

We filled a blank copy of GitLab's public CAIQ v4.0.3 (261 questions) using only GitLab's public handbook policies, then compared the result with the answers GitLab published.

• 158 of 163 filled answers matched GitLab's own answers.
• 0 invented quotes.
• Questions with no proof in the policies stayed empty.

It is one questionnaire and one company. The full benchmark explains the method, the misses and the limits.

FAQ

Which CAIQ version does Citesheet work with?

We measured it on CAIQ v4.0.3, the version GitLab published in March 2025. We have not yet measured v4.1. If you were sent v4.1, send it and we'll tell you how it does.

Can Citesheet answer CAIQ questions my policies don't cover?

No. If no passage in your documents supports the answer, the row says "No proof found" and goes on the gap list. You can answer it yourself, or write the missing policy and run it again.

Will it answer Yes when my policy only partly covers a question?

It tries not to. When a specific condition such as "at least annually" or "all systems" isn't in your documents, the row is marked Needs review with a note saying which part is missing. It can still over-claim sometimes, which is why the quote is always shown and flagged rows need your review. The benchmark lists the cases where it got this wrong.

Do I still need to review the CAIQ before I send it?

Yes, for flagged rows and anything sensitive, such as legal commitments. You can edit or approve each answer.

Can I submit the filled CAIQ to the CSA STAR Registry?

Citesheet fills the file. Whether and how you submit a self-assessment to the STAR Registry is up to you and the CSA's process.

Where do my documents go?

They are used only for your questionnaires. The AI step runs on Google's paid Gemini API, which is not used for training. Data is encrypted in transit and at rest, deleted on request, and we sign an NDA on request.

How Citesheet helps

Your first questionnaire is free, then pilot pricing. Send the CAIQ you were sent and judge the result on that.