CAIQ v4 questionnaire: how suppliers answer it

Published 24 October 2026 · Qlara

The Consensus Assessments Initiative Questionnaire (CAIQ) is the Cloud Security Alliance's spreadsheet of yes/no questions about the security controls in a cloud service. Buyers send it to SaaS, PaaS, and IaaS suppliers because it maps to a public control framework, the Cloud Controls Matrix (CCM). A completed CAIQ documents what a supplier says it does. It is a self-assessment, not a certification, and it is only as useful as the evidence and scope behind each answer.

What the CAIQ is, according to the Cloud Security Alliance

CSA describes the CCM as 197 control objectives organised in 17 domains, from Audit & Assurance and Identity & Access Management to Supply Chain Management and Threat & Vulnerability Management. The CAIQ turns those controls into questions a supplier can answer one by one. CSA states that the questions are based on the CCM and that version 4 contained 261 questions, down from 310 in version 3.1.

Versions matter. CSA's Cloud Controls Matrix page states that version 4.1 of the CCM and CAIQ are now combined, and its STAR Level 1 questionnaire page currently offers CAIQ v4.1. If a buyer sends you an older v3.1 workbook or a shortened in-house variant, the number and wording of questions will differ. Answer the file the buyer actually sent, and note the version in your cover message.

A completed CAIQ can also be submitted to CSA's STAR Registry. CSA calls this STAR Level 1, a self-assessment. STAR Level 2 is a separate, third-party audited level built on SOC 2 attestation or ISO/IEC 27001 certification. Do not describe a Level 1 submission as an audit or a certification.

How CAIQ answers are structured

Each question expects a short answer: Yes, No, or NA where the control does not apply to the service. CAIQ v4 added columns for the shared security responsibility model, so the supplier can state who is responsible for implementing each control, and an optional field to explain. That ownership column is where many supplier answers go wrong.

Keep explanations short and factual. The buyer's reviewer may read hundreds of rows, and a one-sentence explanation that names the document and section is easier to verify than a pasted paragraph of policy text. If a question bundles two requirements, answer both, or say which part does not apply and why.

A SaaS company running on a public cloud does not operate the data centre, but it does configure the storage, the identity system, and the application. A truthful CAIQ separates what the supplier does from what it inherits from its providers, and from what the customer must configure. Copying a provider's answers into your own rows is not the same as implementing the control.

Worked example 1: a Yes that needs its scope stated

The examples in this guide are written by Qlara for illustration. The supplier, its documents, and its answers are fictional, and the question wording is paraphrased rather than quoted from the CAIQ.

Worked example (fictional): Encryption domain, fictional SaaS supplier

Question (paraphrased): Is customer data encrypted at rest?
Answer: Yes
Ownership: Shared. The cloud provider encrypts the underlying storage volumes. The supplier enables encryption on the managed database and object storage it configures and manages access to the keys through the provider's key management service.
Explanation: Customer data in the production database and file storage is encrypted at rest with AES-256. See Encryption Standard v3, section 2.
What a reviewer checks: That the algorithm and the services named match the current Encryption Standard, and that backups are covered too if the buyer asks about them.

Worked example 2: a control you inherit, not operate

Datacenter Security questions ask about physical access, environmental controls, and equipment disposal. A SaaS supplier without its own facilities should not answer Yes as if it ran the building, and it should not answer No as if the control were missing.

Worked example (fictional): Datacenter Security domain, fictional SaaS supplier

Question (paraphrased): Are physical access controls in place for the facilities that host customer data?
Answer: NA for the supplier's own operations
Ownership: Cloud service provider
Explanation: The service runs on a public cloud region in Frankfurt. Physical security is operated by the cloud provider and described in the provider's own audit reports, which the buyer can request from that provider. The supplier has no physical access to these facilities.
What a reviewer checks: That the region named is the one in the Hosting Statement, and that the answer does not imply the provider's report covers the supplier's own controls.

Worked example 3: when the honest answer is No, or the evidence is missing

Audit & Assurance questions often ask whether independent audits are performed. Many young suppliers have no SOC 2 report or ISO/IEC 27001 certificate yet. The answer should say so, and then describe what does exist. If your knowledge base has nothing on the topic, leave the row open as a gap rather than writing something plausible.

Worked example (fictional): Audit & Assurance domain, fictional SaaS supplier

Question (paraphrased): Are independent audits of the service performed at least annually?
Answer: No
Explanation: The supplier does not currently hold a SOC 2 report or an ISO/IEC 27001 certificate. Controls are reviewed internally each year against the Information Security Policy, and an external penetration test was performed on 12 March 2026 (summary available under NDA).
What a reviewer checks: That the test date matches the actual report. If no report is on file, the date stays out of the answer and the row is flagged for follow-up.

A practical sequence for completing a CAIQ

The CAIQ is long, so split the work by domain and keep one person accountable for final answers.

Confirm the CAIQ version and which product or environment the buyer is assessing.
Collect current sources per domain: security policy, access control, encryption, incident response, business continuity, supplier management, and your hosting statement.
List the controls you inherit from cloud providers and keep their reports separate from your own evidence.
Answer Yes, No, or NA per question, fill in ownership, and explain only what the evidence supports.
Mark questions with no source as open, route them to the control owner, and do not send them as Yes.
Have one reviewer read the whole file for consistency before it goes back to the buyer.

Where Qlara fits

Qlara drafts answers for buyer workbooks like the CAIQ from the documents your team has approved, cites the source for each drafted answer, and flags a row as GAP when no source supports it. A person reviews and approves every answer before export, and the export writes into the buyer's original Excel file. Qlara also includes a short CAIQ-lite question pack for practice. It is a working subset, not CSA's official text.

Qlara does not fill in the shared responsibility column on its own judgement, does not submit anything to the STAR Registry, and holds no SOC 2 report or ISO/IEC 27001 certificate itself.

Sources

Cloud Security Alliance: STAR Level 1 Security Questionnaire (CAIQ v4). https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4 (accessed 24 October 2026)
Cloud Security Alliance: Cloud Controls Matrix and CAIQ. https://cloudsecurityalliance.org/research/cloud-controls-matrix (accessed 24 October 2026)
Cloud Security Alliance: What is CAIQ?. https://cloudsecurityalliance.org/articles/what-is-caiq (accessed 24 October 2026)
Cloud Security Alliance: STAR program levels. https://cloudsecurityalliance.org/star/levels (accessed 24 October 2026)

This guide is general information, not legal advice. Check the current version of the source before relying on it.