CAIQ questionnaire questions.

Security governance defines accountability for security, how decisions and policies are established, and how risk is overseen. For a cloud service, its scope follows the organization and service boundaries under assessment.

A compliance response identifies the legal, regulatory, contractual, or industry requirements that apply to the organization and service, and explains how its activities address them. Independent assessments and certifications provide separate assurance, limited to their stated scope and period.

Security organization defines the roles, responsibilities, and reporting paths for protecting systems and information. It covers policy ownership, accountability, separation of duties, and escalation within the assessed service boundary and operating model.

Personnel security addresses role-appropriate screening, confidentiality commitments, security awareness, changes in responsibilities, and the end of employment or engagement. Applicable requirements depend on jurisdiction, role, and employment arrangement.

Physical security protects facilities, equipment, and operating environments through access restrictions, visitor management, and environmental safeguards. For hosted services, identify which physical safeguards are managed by the service provider and which by infrastructure providers.

Asset management identifies systems and information, assigns ownership and classification, and governs them throughout their lifecycle. Handling, maintenance, reuse, and disposal safeguards support their confidentiality, integrity, and availability.

Access control defines which people, services, and other identities may access systems and data, and which actions they are authorized to perform. It covers authentication, authorization, least privilege, access review, and timely removal of permissions that are no longer required.

Operational security is the set of day-to-day practices for maintaining reliable and secure systems. It covers capacity management, malware protection, scheduled processing, and management of operating environments.

Vulnerability management identifies weaknesses, assesses their risk, prioritizes remediation, and tracks fixes through resolution. It also addresses approved exceptions and residual risk.

Change control assesses, authorizes, tests, and introduces modifications to systems and services. It includes a process for urgent changes and recovery or rollback when a change has unintended effects.

Business continuity sustains or restores important services during disruptions. It requires understanding critical dependencies, setting recovery priorities and objectives, maintaining continuity arrangements, and applying lessons from exercises and actual events.

Incident response coordinates the detection, assessment, containment, and resolution of security events. It defines responsibilities and communications, preserves relevant information, guides notification decisions, and captures lessons learned.

Audit logs record security-relevant activity, including access to systems or data and changes to them. Logging controls define relevant system and activity coverage, protect log integrity, set retention, and provide for review.

Network security defines how systems connect and exchange data and protects those communications. Its scope includes network boundaries, segmentation, traffic protections, remote connectivity, and administrative access paths, as defined by the architecture and shared responsibilities.

Encryption in transit protects information while it moves between systems; encryption at rest protects stored information. Key management governs the lifecycle of cryptographic keys and controls access to them.

Data security protects information throughout its lifecycle: creation, classification, access, transfer, retention, and secure deletion. Safeguards are determined by the data’s sensitivity, use, and movement between systems.

Privacy governs how personal data is collected, used, shared, and retained, and how requests from individuals are handled. Applicable responsibilities and requirements depend on the data, processing context, and jurisdictions involved.

Third-party management evaluates and oversees security risk throughout a provider relationship. It covers initial assessment, contractual requirements, ongoing monitoring, service changes, subservice-provider dependencies, and the end of the relationship.

Supply chain security addresses risks introduced by external providers, software, hardware, and other dependencies. It requires visibility into critical components, assessment of associated risks, and escalation of material concerns.

Evidence for an affirmative response should demonstrate that the control applies to the identified service and organizational scope and is in operation. State its coverage, relevant boundaries, and exceptions so the assertion does not exceed the evidence.