What Is the CAIQ? CSA CAIQ v4 and CAIQ-Lite explained

The CAIQ and the Cloud Controls Matrix

The Cloud Security Alliance (CSA) is a nonprofit that publishes best-practice guidance for cloud security. Its core framework is the Cloud Controls Matrix (CCM), a catalog of cloud security control objectives. CCM v4, published in 2021, contains 197 control objectives organized into 17 domains. In January 2026 CSA released CCM v4.1, which adds new control specifications in areas such as datacenter security, logging and monitoring, and vulnerability management.

The CAIQ is the assessment layer on top of the CCM. Where the CCM says what a control should achieve, the CAIQ asks a provider whether it has implemented that control. Since v4, the CCM and CAIQ are published together, with CAIQ questions tied directly to CCM control IDs. That link is what makes the CAIQ useful: a buyer can read one answer and know exactly which control it refers to.

The CAIQ is also the entry ticket to CSA STAR, the Security, Trust, Assurance and Risk registry. A provider that publishes its completed CAIQ to the STAR Registry has a STAR Level 1 self-assessment. STAR Level 2 goes further and requires an independent third-party audit or certification against the CCM.

How the CAIQ v4 Is Structured

CAIQ v4.0 has 261 questions, down from 310 in v3.1. CAIQ v4.1 has 283 questions to cover the new v4.1 controls. CSA accepts both v4.0 and v4.1 submissions for STAR during a transition period that runs until December 2027, after which only v4.1 is accepted. If a customer sends you a CAIQ today, check which version it is before you reuse old answers.

Each row in the spreadsheet has:

• A question ID and question text linked to a CCM control, for example an Identity & Access Management control.
• An answer: Yes, No, or NA (not applicable).
• Shared responsibility ownership, new in v4: whether the control is CSP-owned, CSC-owned (the cloud customer), third-party outsourced, shared between CSP and CSC, or shared between CSP and a third party.
• Implementation descriptions: free-text columns where the provider explains how it meets the control and what the customer remains responsible for. These are optional in the template, but buyers read them closely.

The 17 CCM v4 domains the questions are grouped into:

CAIQ-Lite: the Shorter Version

CAIQ-Lite is a condensed questionnaire CSA publishes for faster vendor assessments. The current version, derived from CCM v4.1, contains 138 questions across the same 17 domains. Buyers tend to use it for lower-risk suppliers, for an initial screening before deciding whether a full assessment is needed, or when they want a quick comparison across many vendors.

Because CAIQ-Lite questions are drawn from the full CAIQ, a well-maintained full CAIQ answer set covers CAIQ-Lite too. Keep one source of truth and answer the Lite version from it, rather than maintaining two drifting documents.

Who Asks for a CAIQ, and Why

The CAIQ is aimed at cloud services, so it tends to arrive at SaaS, PaaS, and IaaS vendors. Typical senders are procurement or third-party risk teams at enterprises, regulated firms in financial services and healthcare, and public-sector buyers. Some attach it to an RFP; others send it once a deal reaches security review.

Buyers like the CAIQ because it is free, vendor-neutral, and standardized, which makes answers comparable across providers. It sits alongside other common formats: the Shared Assessments SIG questionnaire is broader and covers non-cloud third-party risk, while many companies still send a custom vendor security questionnaire of their own. If you publish a CAIQ to the STAR Registry, you can often point buyers to it instead of filling in yet another spreadsheet.

How to Answer the CAIQ Fast (Without Cutting Corners)

For a tool-agnostic version of this workflow, see how to automate security questionnaires.

Common CAIQ Mistakes

• Answering Yes without evidence. Every Yes is a claim a buyer can audit or write into the contract. If you cannot point to a policy, report, or configuration, the honest answer is No or a qualified Yes with an explanation.
• Overusing NA. Not applicable should mean the control genuinely does not apply to the service, with a one-line reason. Buyers treat unexplained NA answers as gaps.
• Ignoring the ownership columns. Leaving shared responsibility blank or marking everything CSP-owned makes the answer set look careless and invites a follow-up call.
• Letting answers drift. When your CAIQ says one thing and last month's SIG says another, reviewers notice. One answer library, reviewed on a schedule, prevents contradictions.
• Reusing v4.0 answers on a v4.1 form unchecked. v4.1 adds controls, so a copy-paste leaves new questions blank or misaligned.