Glossary

Consensus Assessments Initiative Questionnaire (CAIQ)

The Consensus Assessments Initiative Questionnaire (CAIQ) is the Cloud Security Alliance’s standardized security questionnaire for cloud providers. It asks a fixed set of yes-or-no questions mapped to the alliance’s Cloud Controls Matrix, so buyers can compare providers on the same terms instead of writing bespoke questionnaires from scratch.

Assemble Your GRC Team

Last updated July 26, 2026

A standard answer set for cloud security

The CAIQ exists to kill duplicate effort. Rather than every buyer drafting their own cloud-security questions, the Cloud Security Alliance publishes one set, keyed to the control catalog in its Cloud Controls Matrix, and a provider answers it once. The completed document is designed to travel: vendors publish theirs through the alliance’s public registry or on a trust center, turning a per-deal chore into a reusable, inspectable artifact.

Where it stops and the SIG begins

The two big standardized questionnaires are not interchangeable, and the difference is scope. The CAIQ is cloud-specific and comparatively compact — assertion-style questions about a cloud service’s controls, built so a buyer can evaluate providers quickly. The Standardized Information Gathering (SIG) questionnaire, maintained by Shared Assessments, is a general-purpose third-party-risk instrument: broader domains, scalable depth, aimed at vendors of every kind rather than cloud platforms alone. A bank’s vendor-risk office tends to send a SIG; a cloud-native buyer will often accept your published CAIQ and move on.

Answering it once, well

A fixed question set rewards preparation. Build the answer library once, keep it synchronized with your certifications and your actual stack, and every future request becomes an export rather than a week-long research project. Agency maintains that library and completes the CAIQ — along with the bespoke security questionnaires buyers write themselves — through our questionnaire service.

Keep exploring

Security Questionnaire Services

CAIQs, SIGs, and homegrown spreadsheets — answered from one maintained library.

SIG Questionnaire

The general-purpose enterprise questionnaire — and when you’ll see it instead.

Security Questionnaire

The umbrella term: standardized, bespoke, and everything in between.

Questionnaire Fatigue

Publish one CAIQ, reuse it everywhere

Agency builds and maintains your standardized answers so cloud-security reviews stop consuming engineering time. Rated 4.9 out of 5 stars on G2.

Assemble Your GRC Team