Pass your CAIQ security questionnaire
Most CAIQ questions assume you have a pentest, scans, and policies in hand. Pentest Today generates that evidence so your answers are 'yes — here's proof.'
What a CAIQ review asks for
The Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ) is a standardized set of yes/no security questions mapped to the Cloud Controls Matrix.
What closes each requirement
| Control | What they ask | Evidence | Where it comes from |
|---|---|---|---|
| TVM · threat and vulnerability management | Whether testing runs on a defined cadence and last round's findings actually closed — the row's 'yes' is worthless without a report a reviewer can open and check the date on. | The penetration test report, scoped to the assessed environment, plus the retest that restates each finding as fixed or not fixed — the artifact behind the 'yes' rather than the word alone. | The pentest workflow's client-ready PDF and the retest workflow. |
| IAM · identity and access management | Whether accounts are individually attributable, whether administrative access requires a second factor, and whether access gets reviewed on a cadence — three separate questions a rushed CAIQ answer often collapses into one blanket 'yes'. | The Access Control Policy's account, authentication, and review sections, with the enforcement scope pulled from the intake's own authentication method and MFA status instead of asserted. | The policy pack, generated from the intake's authMethod and mfaStatus fields. |
| CEK · cryptography, encryption and key management | Which algorithms protect data at rest and in transit, and who holds the keys — not whether encryption is used at all, which every vendor already answers yes to. | The Data Handling Policy's encryption standard, filled in from the intake's own encryption summary where one exists, and marked to be confirmed rather than guessed where it doesn't. | The policy pack, from the intake's encryptionSummary field. |
| SEF · security incident management | Whether a documented process exists for detecting, triaging, and closing an incident, with a named owner and a defined communication path — asked before anything has gone wrong, not after. | The Incident Response Policy, checked for two things a reviewer actually verifies: a named individual accountable for running the process, and a lifecycle that goes past 'we noticed' into containment and recovery. | The policy pack, drawing its named contact directly from the intake's incidentResponseOwner field rather than a generic title. |
| STA · supply chain management, transparency and accountability | Which subprocessors touch the environment, how each was assessed before onboarding, and whether that list is the same one the architecture diagram draws — a mismatch here is the fastest way to lose a reviewer's confidence in the rest of the submission. | The Vendor Management Policy's assessment and tiering process, checked against the generated architecture and data-flow diagram, which draws each third party outside the trust boundary instead of naming it in a sentence. | The policy pack and the diagram generator, both built from the intake's keyVendors field, so the list on the row and the drawing can't disagree. |
| DSP · data security and privacy lifecycle | How customer data is classified, where it's permitted to travel, and what happens to it at the end of its life — retention and deletion, not only where it sits today. | The Data Handling Policy's classification and retention sections, scoped to the data types and hosting setup the intake actually names rather than a generic default. | The policy pack, generated from the intake's customerDataTypes and hostingSetup fields. |
A CAIQ row, answered against the CCM
Illustrative example of reviewed rows. The generator's own draft carries a draft answer, an evidence source, a confidence level and a review flag per row; this is what a row looks like after that review. Not taken from a customer engagement.
How this review actually runs
A CAIQ typically arrives one of two ways: a buyer sends the spreadsheet directly, or a buyer asks whether you're listed in the CSA STAR registry and reads your public entry instead of sending their own copy. Both paths test the same seventeen Cloud Controls Matrix domains, and both expect the same thing behind every 'yes' — an artifact a reviewer could actually open, not just an assertion.
Answering it starts the way answering any vendor security questionnaire does: each row gets matched against a topic, and a draft is grounded in your intake and the documents already in your security packet wherever they cover it. The deterministic baseline returns four things for a matched row — a draft answer, a named evidence source, a confidence level, and a review flag — before anything reaches a reviewer. What actually ships is reviewed and edited from there, so the specific confidence attached to any one delivered answer isn't something to take as fixed; the four-field shape is what holds.
Where it fails is predictable: a 'yes' with no evidence source named, because the row read like every other yes/no question and got answered from memory instead of from a document. A STAR listing amplifies that failure rather than hiding it — a reviewer who checks your public entry against the questionnaire you actually sent finds the same gap twice.
What gets this sent back
Scan
Authenticated and external scans across web, API, and cloud surface the issues before an assessor does — de-duped, triaged, and mapped to CVE/CVSS.
Pentest
Approved-target scans become a client-ready pentest report: validated findings, evidence, reproduction steps, remediation, and the retest letter auditors accept.
Policy Generator
Generate the policies and system architecture diagrams the review expects — access control, cryptography, incident response — pre-mapped to controls.
Start your Pentest
Our agent swarm and human experts test your endpoints and deliver an audit, fast.
SIG
The Shared Assessments Standardized Information Gathering (SIG) questionnaire is a comprehensive third-party risk questionnaire used across industries.
Vendor Security Questionnaire
Enterprise buyers send a security questionnaire before they'll sign — asking how you test, protect, and monitor their data.
SOC 2
SOC 2 is an AICPA report on how your controls meet the Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy.
SOC 2 Type II
A SOC 2 Type II report tests whether your controls operated effectively across an observation window, not just on paper.
ISO 27001
ISO/IEC 27001 certifies that you run an Information Security Management System (ISMS) with the Annex A controls in place.
HIPAA
The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI).
CAIQ, answered
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire is a Cloud Security Alliance document mapping yes/no security questions to the seventeen domains of the Cloud Controls Matrix. Cloud providers publish answers, sometimes to the CSA STAR registry, so buyers evaluating them read one standardized answer set instead of a custom questionnaire.
Do I have to answer every CAIQ question?
Most buyers expect a complete response, but 'not applicable' with a stated reason is a legitimate answer for a domain that genuinely doesn't apply to your service model. What draws scrutiny is a blank row or a 'yes' with nothing behind it — both read as unanswered rather than as a considered response.
What's the difference between the CAIQ and a general vendor security questionnaire?
The CAIQ is one standardized document mapped to the Cloud Controls Matrix; a vendor security questionnaire is whatever a specific buyer's team wrote, and its rows vary by company. Most of the underlying evidence overlaps, which is why a maintained answer library serves both instead of starting each one from a blank page.
What does publishing to the CSA STAR registry actually do?
Publishing to the CSA STAR registry puts a completed CAIQ where a buyer can read it before a deal even starts, instead of waiting for one to be sent. It doesn't replace the underlying evidence — a reviewer who finds a STAR listing still expects the same artifacts behind it that a mailed questionnaire would need.
Does a CAIQ 'yes' need evidence attached?
Yes, in practice. Every affirmative answer implies evidence exists somewhere, even when the question doesn't ask for it directly. Reviewers who catch one unbacked 'yes' tend to re-check the rest of the sheet, so the safer habit is attaching the document behind every affirmative rather than waiting to be asked.
How often does a CAIQ need to be updated?
Annually is the common expectation, and again after a change that affects a domain's answer — a new subprocessor, a changed encryption standard, a new region. Because the underlying evidence is what actually changes, updating the source documents and regenerating answers keeps a STAR listing from going stale.
Is the pentest a real test or just a scanner dump?
Both scanning and AI triage are scoped to your approved targets, and every finding is reviewed and signed off by a human before delivery — so the report reflects verified findings, not raw scanner noise.
How fast can I get a report?
Most reports turn around in hours, not weeks. You connect an approved target, we scan and verify, and you export a client-ready report and policy pack.
Get the evidence for your CAIQ review this week.
Start a scan on an approved target and walk in with the report, policies, and diagrams already done.