CAIQ

What is the CAIQ?

The CAIQ (Consensus Assessments Initiative Questionnaire) is a questionnaire from the Cloud Security Alliance (CSA). A cloud provider answers it to show how it meets each control in CSA's Cloud Controls Matrix (CCM), a framework of cloud security controls. CSA describes it as a simple set of "yes/no" questions.

The two go together. The CCM is the list of controls. The CAIQ turns each control into questions the provider answers, so customers and auditors can check what the provider says it does. Since version 4, the CAIQ also asks who is responsible for each control: the provider, the customer or both. CSA calls this the Shared Security Responsibility Model.

It covers ground similar to the SIG questionnaire, but only for cloud providers, and the SIG lists the CAIQ among the frameworks it maps to.

Versions: v4.0 and v4.1

• CAIQ v4.0: released June 7, 2021, with 261 questions, down from 310 in the version before.
• CAIQ v4.1: released with CCM v4.1 in January 2026, with 283 questions. CCM v4.1 has 207 controls across 17 security domains.

CSA's STAR program, below, accepts submissions on either version until December 2027 and plans to withdraw the v4.0 documents in January 2028. So, as of October 2026, you will see both versions, and a v4.0 answer set does not answer the questions CSA added or changed in v4.1.

The STAR Registry and STAR levels

CSA's STAR Registry is a public list of providers and their security assessments. As of October 2026 it lists more than 2,800 organizations. Each listing shows the service, the date, the STAR level and a status such as current or expired.

• STAR Level 1: a self-assessment. The provider submits its completed CAIQ, directly or through Valid-AI-ted, an optional CSA service that uses AI to score the answers (free for CSA members, paid for others). CSA has described Level 1 as a complimentary offering, and it says a self-assessment is valid for one year.
• STAR Level 2: a third-party audit paired with a CAIQ: an ISO/IEC 27001 certification, a SOC 2 attestation, or C-STAR for the Greater China market. Level 2 has fees.

CSA also runs STAR for AI, built on its AI Controls Matrix, with an AI-CAIQ that AI services complete in the same way.

Why it matters to you

A CAIQ can save you a round of questions. Before you send your own security questionnaire, check whether the vendor already has a STAR listing. The answers follow a standard format, so you can compare cloud providers line by line during a vendor risk assessment.

But a Level 1 CAIQ is the vendor's own word. No auditor checks the answers. Treat it as a map of what to verify, then ask for audit evidence such as a SOC 2 report or an ISO 27001 certificate.

The responsibility answers matter too. Where the CAIQ says a control is the customer's job, or shared, closing that gap is up to you.

What to check

• Listing: whether the vendor's service is in the STAR Registry, and whether the listing is current, expiring or expired.
• Level: Level 1 (self-assessment) or Level 2 (third-party audit).
• Version and date: v4.0 or v4.1, and when it was submitted. A Level 1 self-assessment older than a year has lapsed.
• Service: that the listing covers the product you buy, not another product from the same company.
• Responsibility: every control marked as yours or shared, and who on your side owns it.
• "No" answers: each one, and whether the provider explains it.
• Match: whether the answers about data handling match the vendor's DPA and subprocessor list.

How Venpo helps

A Level 1 CAIQ is a snapshot that lasts a year. The vendor's public legal documents can change in between. Venpo watches your vendors' DPAs, privacy policies, subprocessor lists and other public legal pages, and emails you a plain-English alert when one changes, so you know when CAIQ answers about data handling may no longer hold.

Each vendor gets a change history with a redline of each change, so you can show what a document said before and when it changed.