# CAIQ controls One page per CAIQ v4 control: what it asks in plain English, which policy usually proves it, short quoted evidence from real public policies, and when N/A is honest. **How these pages are made.** We start with the Identity & Access Management (IAM) domain of CAIQ v4.0.3, the version we [tested Citesheet on](https://citesheet.com/benchmark/). Each page explains a control in plain English and quotes short passages from public security policies that prove it, or says when we found none. **Credits.** The CAIQ and Cloud Controls Matrix are © Cloud Security Alliance; questions are paraphrased here, not reproduced. Quotes from the GitLab Handbook are under CC BY-SA 4.0, from Tailscale's security policies under CC0, and from the PostHog handbook under MIT. Each quote links to its source. “How GitLab answered” refers to GitLab's CAIQ v4.0.3 self-assessment on the CSA STAR Registry, dated 2025-03-25\. The registry listing now shows a newer v4.1.0 submission; we haven't compared it. * [CAIQ IAM-01: Identity and access management policyWhat CAIQ v4 control IAM-01 asks, which policy proves it, quoted examples from GitLab and Tailscale, and when the annual review question needs care.Updated October 20, 2026](https://citesheet.com/caiq/iam-01-identity-and-access-management-policy/) * [CAIQ IAM-02: Strong password policyWhat CAIQ v4 control IAM-02 asks about password policy, which document proves it, quoted examples from GitLab, Tailscale and PostHog, and common gaps.Updated October 20, 2026](https://citesheet.com/caiq/iam-02-strong-password-policy/) * [CAIQ IAM-03: Identity inventoryCAIQ v4 control IAM-03 asks whether you keep and review a record of who has which access. What proves it, quoted examples, and where policies fall short.Updated October 20, 2026](https://citesheet.com/caiq/iam-03-identity-inventory/) * [CAIQ IAM-04: Separation of dutiesCAIQ v4 control IAM-04 asks whether no one person can both make and approve a risky change. What proves it in a small company, quoted examples, and honest answers.Updated October 20, 2026](https://citesheet.com/caiq/iam-04-separation-of-duties/) * [CAIQ IAM-05: Least privilegeCAIQ v4 control IAM-05 asks whether people and systems get only the access they need. What proves it, quoted examples from Tailscale, GitLab and PostHog, and gaps.Updated October 20, 2026](https://citesheet.com/caiq/iam-05-least-privilege/) * [CAIQ IAM-06: User access provisioningCAIQ v4 control IAM-06 asks whether access is granted through a process that approves, records and communicates each change. Quoted examples and sample answers.Updated October 20, 2026](https://citesheet.com/caiq/iam-06-user-access-provisioning/) * [CAIQ IAM-07: User access changes and revocationCAIQ v4 control IAM-07 asks whether leavers and movers lose access in a timely manner. Why "timely" needs a number, quoted examples, and sample answers.Updated October 20, 2026](https://citesheet.com/caiq/iam-07-user-access-changes-and-revocation/) * [CAIQ IAM-08: User access reviewCAIQ v4 control IAM-08 asks whether you regularly re-check who has access. What proves it, why the frequency matters, quoted examples, and sample answers.Updated October 20, 2026](https://citesheet.com/caiq/iam-08-user-access-review/) * [CAIQ IAM-09: Segregation of privileged access rolesCAIQ v4 control IAM-09 asks whether admin access to data, encryption keys and logs is held by separate roles. What proves it, what public policies show, and honest answers.Updated October 20, 2026](https://citesheet.com/caiq/iam-09-segregation-of-privileged-access-roles/) * [CAIQ IAM-10: Management of privileged access rolesCAIQ v4 control IAM-10 asks whether admin rights are granted for a limited time and can't quietly pile up. What proves it, what public policies show, and honest answers.Updated October 20, 2026](https://citesheet.com/caiq/iam-10-management-of-privileged-access-roles/) ## Send one questionnaire. See the proof. First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps. Send your first questionnaire free Takes about 15 seconds. Or email [hello@citesheet.com](mailto:hello@citesheet.com). Need an NDA first? Ask, and we'll sign before you send anything.