Cloud Security Alliance updates its CAIQ to increase value for cloud service providers and customers

The Cloud Security Alliance (CSA) released an update to its Consensus Assessment Initiative Questionnaire (CAIQ), a set of questions that allow cloud consumers and auditors to ascertain a cloud service provider’s compliance with the Cloud Controls Matrix (CCM).

With CAIQv4, users can showcase additional accountability and transparency regarding their security and privacy practices, providing additional value for both cloud service providers (CSP) and customers (CSC).

“This update addresses what is arguably one of the biggest risks in the cloud ecosystem — the lack of understanding of the shared responsibility model. The information gap between the various parties in the cloud supply chain has become the cause of easily avoidable cloud security and privacy breaches. With these additions to CAIQ, and consequently to the STAR Registry, CSA is facilitating cloud customers with their vendor and third-party management process, as well as in building a well-defined cloud security, privacy and accountability program,” said Daniele Catteddu, Chief Technology Officer, Cloud Security Alliance.

Among the updates included in CAIQv4 are:

• A more streamlined set of questions (261 compared to 310 in the previous version)
• Changes in the structure of the document used for the submissions to Security, Trust, Assurance and Risk (STAR) Registry Level 1
• Additional sections related to the Shared Security Responsibility Model (SSRM), which lets CSPs better describe the allocation of the responsibility for the implementation of a CCMv4 control. The new feature not only allows the CSP to further explain what it is doing to satisfy the requirements for which it’s responsible, but also what the CSC is expected to do in order to comply with its responsibilities.

CSA will start accepting the submission to STAR Level 1 based on CAIQ v4 in early July. Users should note that there are two separate versions of the CAIQ:

• CCM + CAIQ v4: Includes only the questionnaire and is folded into the CCM file (This version cannot be used to submit to STAR).
• STAR Level 1: Security Questionnaire (CAIQ v4): Used to submit to the STAR registry and includes all the necessary features, including the SSRM.