/caiq-generate

description: Generate CAIQ (Consensus Assessments Initiative Questionnaire) responses

CSA CAIQ Generator

Generates responses for the Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ), a standardized self-assessment tool for cloud service providers.

Arguments

• `$1` - CAIQ version (required: v4.0, lite)
• `$2` - Output format (optional: markdown, json, excel, csv)
• `$3` - Response mode (optional: full, draft, template)

CAIQ Overview

**Purpose**: Standardized cloud security questionnaire **Audience**: Cloud service providers, customers conducting vendor due diligence **Structure**: 197 yes/no questions aligned to CCM v4.0 **Use Cases**:

• Vendor security assessments
• RFP responses
• Customer due diligence
• Publicly shareable security posture
• CSA STAR Level 1 self-assessment

CAIQ Versions

CAIQ v4.0 (Full)

• **Questions**: 197 aligned to CCM v4.0
• **Response Format**: Yes/No + Evidence
• **Domains**: All 17 CCM domains
• **Effort**: 40-80 hours to complete
• **Use Case**: Comprehensive cloud security assessment

CAIQ Lite

• **Questions**: Reduced subset (~50 questions)
• **Response Format**: Yes/No
• **Domains**: Core security domains only
• **Effort**: 10-20 hours to complete
• **Use Case**: Quick vendor assessments, initial due diligence

CAIQ Question Structure

Each CAIQ question follows this format:

**Control ID**: CCM domain and control number (e.g., CEK-01)

**Question**: Yes/No question about control implementation

**Response Options**:

• **Yes**: Control is fully implemented
• **No**: Control is not implemented or partially implemented

**Evidence**: Description of how control is implemented, including:

• Policies and procedures
• Technical implementations
• Third-party certifications
• Audit reports
• Responsible party

17 Domain Breakdown

A&A - Audit and Assurance (6 questions)

Example questions:

• Do you conduct annual independent audits or assessments?
• Do you have SOC 2 Type II certification?
• Are third-party audit reports available to customers?

**Key Evidence**:

• SOC 2 Type II reports
• ISO 27001 certificates
• Penetration test reports
• CAIQ self-assessment

AIS - Application & Interface Security (11 questions)

Example questions:

• Do you follow a secure software development lifecycle (SDLC)?
• Are APIs protected with authentication and authorization?
• Do you perform automated application security testing (SAST/DAST)?

**Key Evidence**:

• SDLC documentation
• OWASP Top 10 mitigation
• API authentication mechanisms (OAuth, API keys)
• SAST/DAST tool reports

BCR - Business Continuity & Operational Resilience (11 questions)

Example questions:

• Do you have a documented business continuity plan (BCP)?
• Do you test disaster recovery procedures annually?
• Are SLA targets defined and monitored (e.g., 99.9% uptime)?

**Key Evidence**:

• BCP/DR documentation
• DR test results
• SLA metrics and uptime reports
• Redundancy architecture

CCC - Change Control & Configuration Management (9 questions)

Example questions:

• Do you have a formal change management process?
• Are baseline configurations defined and enforced?
• Is configuration management automated (IaC)?

**Key Evidence**:

• Change Advisory Board (CAB) procedures
• CIS Benchmarks or hardening guides
• Infrastructure as Code (Terraform, CloudFormation)
• Configuration management tools

CEK - Cryptography, Encryption & Key Management (15 questions)

Example questions:

• Is data encrypted at rest?
• Is data encrypted in transit (TLS 1.2+)?
• Are encryption keys managed in a Hardware Security Module (HSM)?
• Is key rotation automated?

**Key Evidence**:

• Encryption policies
• TLS/SSL configuration
• AWS KMS, Azure Key Vault, or HSM usage
• Key rotation procedures
• FIPS 140-2 compliance

DCS - Data Security & Privacy Lifecycle Management (12 questions)

Example questions:

• Is data classified according to sensitivity?
• Are data retention policies defined and enforced?
• Is Data Loss Prevention (DLP) implemented?
• Are test environments using anonymized data?

**Key Evidence**:

• Data classification scheme
• Retention schedules
• DLP tool implementation
• Data anonymization procedures

DSP - Data Security & Privacy (13 questions)

Example questions:

• Do you conduct Data Protection Impact Assessments (DPIAs)?
• Can customers exercise data subject rights (access, deletion, portability)?
• Is consent management implemented?
• Are data breaches reported within 72 hours?

**Key Evidence**:

• DPIA documentation
• Data subject request portal
• Consent management platform
• Breach notification procedures
• GDPR/CCPA compliance programs

GRC - Governance, Risk & Compliance (14 questions)

Example questions:

• Is there an information security governance framework?
• Are risk assessments conducted annually?
• Are security policies reviewed and updated regularly?
• Is there executive-level security oversight (CISO, security committee)?

**Key Evidence**:

• Security governance framework
• Risk assessment reports
• Policy management system
• Board/executive reporting
• CISO role definition

HRS - Human Resources (10 questions)

Example questions:

• Are background checks conducted on employees?
• Is annual security awareness training mandatory?
• Are access rights revoked immediately upon termination?

**Key Evidence**:

• Background check procedures
• Training completion records
• Deprovisioning workflows
• Contractor security agreements

IAM - Identity & Access Management (16 questions)

Example questions:

• Is multi-factor authentication (MFA) required for all users?
• Are privileged accounts managed separately?
• Are access reviews conducted quarterly?
• Is Single Sign-On (SSO) implemented?

**Key Evidence**:

• SSO implementation (Okta, Azure AD)
• MFA enforcement policies
• Privileged Access Management (PAM) solution
• Access review logs

IPY - Interoperability & Portability (5 questi