Draft
What is the CAIQ?
By The Citesheet team · Published
Short answer
The CAIQ (Consensus Assessments Initiative Questionnaire) is a security questionnaire from the Cloud Security Alliance. It turns the CSA's Cloud Controls Matrix into yes/no questions that a cloud or SaaS provider answers about itself: 261 questions in version 4.0 and 283 in version 4.1. Buyers send it as an Excel file, and providers can publish a completed one on the CSA STAR Registry.
The CAIQ (Consensus Assessments Initiative Questionnaire) is a security questionnaire published by the Cloud Security Alliance (CSA). A cloud or SaaS provider answers it about itself, so customers can see which security controls it has.
How it is built
The CAIQ is the question form of the CSA's Cloud Controls Matrix (CCM), a control framework of 197 control objectives in 17 domains, such as Identity & Access Management and Logging & Monitoring. The CSA describes the CAIQ as a "simple set of 'yes/no' questions." Each question is answered Yes, No or NA, with optional columns for who owns the control (provider or customer) and an explanation.
Versions
- v4.0: 261 questions, down from 310 in v3.1.
- CAIQ-Lite: a shorter version with 124 questions that still covers every domain.
- v4.1: 283 questions, released on January 28, 2026. The CSA says the STAR Registry will accept both v4.0 and v4.1 until December 2027.
Where you'll meet it
Buyers send it as an Excel file during security review. Providers can also publish a completed CAIQ on the CSA STAR Registry as a level one self-assessment. For examples of what each control asks and how public policies prove it, see our CAIQ control pages.
Sources
- Cloud Security Alliance: What is CAIQ? (accessed )
- Cloud Security Alliance: Cloud Controls Matrix (CCM) (accessed )
- Cloud Security Alliance: CCM v4.1 transition timeline (Feb 19, 2026) (accessed )
- CSA STAR Registry (accessed )