Skip to main content

CAIQ Security Questionnaire

The Cloud Security Alliance (CSA) publishes the Consensus Assessments Initiative Questionnaire (CAIQ). Enterprise reviewers use it to assess a cloud vendor. SigmaShake wrote a CAIQ self-assessment for ssg and the SigmaShake cloud services.

Self-assessment, draft status

SigmaShake wrote this document. No independent assessor reviewed it. It is not an audit. It is not an attestation. It is not a certification. It is not a CSA STAR registry entry. The operator review of the answers is not finished. The document is marked DRAFT: operator review pending.

How to get it​

  • The self-assessment is available under NDA. Go to trust.sigmashake.com/report?type=caiq and accept the NDA.
  • You can also send your own questionnaire. Write to [email protected]. SigmaShake completes questionnaires for each customer on request.
  • No pre-filled SIG-Lite or VSA is published.

What the document covers​

  • The 17 control domains that the CSA names for its Cloud Controls Matrix (CCM) version 4.1.
  • Each question has one answer: Yes, Partial, No, or Not applicable.
  • Each answer has one evidence pointer and one short note. The note states what is in place and what is not.
  • An answer of Yes means that SigmaShake states the control is in place. SigmaShake did not test the operating effectiveness of the control with an independent assessor.

Known limits​

  • The CSA question workbook is behind a download form. SigmaShake did not read the CSA control IDs or the CSA question text. The questions in the document are written by SigmaShake for each CCM domain.
  • The question numbers in the document are local numbers. They are not CSA control IDs.
  • If you need the exact CSA workbook, ask for a transfer of the answers into that file. The transfer is manual.
  • The document records open gaps as No or Partial answers. For example, no independent assessor and no third-party penetration test firm are engaged.