ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
v4.0.2+0CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE VERSION 4.0.2
2
Introduction
3
4
Consensus Assessments Initiative Questionnaire (CAIQ):
5
This tab includes the questionnaire associated with the Cloud Control Matrix (CCM) controls, commonly known as the CAIQ.
6
The Consensus Assessments Initiative Questionnaire version 4 (or CAIQv4.0.2) aligns with the CCMv4.0.2 control specifications. The CAIQv4.0.2’s
purpose is to help organizations conduct self-assessments to test their compliance against the CCM V4. It is developed under CSA’s STAR-Level 1
program umbrella, allowing organizations to complete and submit self-assessments to CSA’s STAR Registry.
7
The CAIQv4.0.2 features 261 questions structured and formulated based on the 17 domains and underlying control specifications of the CCM.
8
Each question is described using the following attributes:
9
10
Question ID
11
The question identifiers.
12
13
Assessment question
14
The description of the question.
15
In addition, this tab includes the following sections (groups of columns).
16
17
CSP CAIQ answer
18
The Cloud Service Provider (CSP) must respond with “Yes”/ ”No”/ ”NA” next to the corresponding assessment question, and for the portion(s) of the
CCM control specification they are responsible and accountable for implementing.
19
Meaning of possible replies:
20
• “Yes”: The portion(s) of the CCM control requirement corresponding to the assessment question is met.
21
• “No”: The portion(s) of the CCM control requirement corresponding to the assessment question is not met.
22
• “N/A”: The question is not in scope and does not apply to the cloud service under assessment.
23
24
Shared security responsibility model (SSRM) control ownership
25
The CSP control responses shall identify control applicability and ownership for their specific service.
26
• CSP-owned: The CSP is entirely responsible and accountable for the CCM control implementation.
27
• CSC-owned: The Cloud Service Customer (CSC) is entirely responsible and accountable for the CCM control implementation.
28
• Third-party outsourced: The third-party CSP in the supply chain (e.g., an IaaS provider) is responsible for CCM control implementation, while
the CSP is fully accountable.
29
• Shared CSP and CSC: Both the CSP and CSC share CCM control implementation responsibility and accountability.
30
• Shared CSP and third party: Any CCM control implementation responsibility is shared between CSP and the third party, but the CSP remains fully
accountable.
31
Note: The CAIQv4 SSRM schema is tailored to CCMv4’s Supply Chain Management, Transparency, and Accountability (STA) domain, controls 1-6, and
their corresponding implementation guidelines.
32
33
CSP implementation description (optional/recommended)
34
A description (with references) of how the cloud service provider meets (or does not meet) the portion(s) of the SSRM control they are
responsible for. If “NA,” explain why.
35
36
CSC responsibilities (optional/recommended)
37
A summary description of the cloud service customer security responsibilities for the portion(s) of the SSRM control that is responsible for,
with corresponding guidance and references.
38
39
End of Introduction
40
© Copyright 2019-2021 Cloud Security Alliance - All rights reserved. You may download, store, display on your computer, view, print, and link to
the Cloud Security Alliance “Cloud Controls Matrix (CCM) Version 4.0.2” at http://www.cloudsecurityalliance.org subject to the following: (a) the
Cloud Controls Matrix v4.0.2 may be used solely for your personal, informational, non-commercial use; (b) the Cloud Controls Matrix v4.0.2 may not
be modified or altered in any way; (c) the Cloud Controls Matrix v4.0.2 may not be redistributed; and (d) the trademark, copyright or other notices
may not be removed. You may quote portions of the Cloud Controls Matrix v4.0.2 as permitted by the Fair Use provisions of the United States
Copyright Act, provided that you attribute the portions to the Cloud Security Alliance Cloud Controls Matrix Version 4.0.2. If you are interested
in obtaining a license to this material for other usages not addresses in the copyright notice, please contact info@cloudsecurityalliance.org.
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100