CAIQ controls
One page per CAIQ v4 control: what it asks in plain English, which policy usually proves it, short quoted evidence from real public policies, and when N/A is honest.
How these pages are made. We start with the Identity & Access Management (IAM) domain of CAIQ v4.0.3, the version we tested Citesheet on. Each page explains a control in plain English and quotes short passages from public security policies that prove it, or says when we found none.
Credits. The CAIQ and Cloud Controls Matrix are © Cloud Security Alliance; questions are paraphrased here, not reproduced. Quotes from the GitLab Handbook are under CC BY-SA 4.0, from Tailscale's security policies under CC0, and from the PostHog handbook under MIT. Each quote links to its source. “How GitLab answered” refers to GitLab's CAIQ v4.0.3 self-assessment on the CSA STAR Registry, dated 2025-03-25. The registry listing now shows a newer v4.1.0 submission; we haven't compared it.
- CAIQ IAM-01: Identity and access management policyWhat CAIQ v4 control IAM-01 asks, which policy proves it, quoted examples from GitLab and Tailscale, and when the annual review question needs care.Updated
- CAIQ IAM-02: Strong password policyWhat CAIQ v4 control IAM-02 asks about password policy, which document proves it, quoted examples from GitLab, Tailscale and PostHog, and common gaps.Updated
- CAIQ IAM-03: Identity inventoryCAIQ v4 control IAM-03 asks whether you keep and review a record of who has which access. What proves it, quoted examples, and where policies fall short.Updated
- CAIQ IAM-04: Separation of dutiesCAIQ v4 control IAM-04 asks whether no one person can both make and approve a risky change. What proves it in a small company, quoted examples, and honest answers.Updated
- CAIQ IAM-05: Least privilegeCAIQ v4 control IAM-05 asks whether people and systems get only the access they need. What proves it, quoted examples from Tailscale, GitLab and PostHog, and gaps.Updated
- CAIQ IAM-06: User access provisioningCAIQ v4 control IAM-06 asks whether access is granted through a process that approves, records and communicates each change. Quoted examples and sample answers.Updated
- CAIQ IAM-07: User access changes and revocationCAIQ v4 control IAM-07 asks whether leavers and movers lose access in a timely manner. Why "timely" needs a number, quoted examples, and sample answers.Updated
- CAIQ IAM-08: User access reviewCAIQ v4 control IAM-08 asks whether you regularly re-check who has access. What proves it, why the frequency matters, quoted examples, and sample answers.Updated
- CAIQ IAM-09: Segregation of privileged access rolesCAIQ v4 control IAM-09 asks whether admin access to data, encryption keys and logs is held by separate roles. What proves it, what public policies show, and honest answers.Updated
- CAIQ IAM-10: Management of privileged access rolesCAIQ v4 control IAM-10 asks whether admin rights are granted for a limited time and can't quietly pile up. What proves it, what public policies show, and honest answers.Updated
Send one questionnaire. See the proof.
First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps.
Takes about 15 seconds. Or email hello@citesheet.com.
Need an NDA first? Ask, and we'll sign before you send anything.