Lion Cipher Lab
Assess a cloud vendor with the CSA CAIQ
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When you put your data in someone else's cloud, you inherit their security posture but you keep the accountability — if they lose your customers' records, it is your name in the notification letter. The hard part for a beginner is knowing what to even ask a cloud provider. The Cloud Security Alliance (CSA) already solved that: the Cloud Controls Matrix (CCM) is a cloud-specific catalog of the controls that matter, and the Consensus Assessments Initiative Questionnaire (CAIQ) turns each control into a plain yes/no/NA question the provider answers about itself. Thousands of providers publish a…
What you'll learn
- cloud vendor risk assessment
- using the CSA Cloud Controls Matrix (CCM)
- reading and scoring a CAIQ
- the shared responsibility model (IaaS vs SaaS)
- the CSA STAR registry and assurance levels
- computing a residual-risk / coverage score
- telling self-attested evidence from audited evidence
- writing a follow-up and compensating-control list
Steps in this lab
- The words this lab runs on
- Shared responsibility: who secures what
- When the CAIQ is the right tool — and when it is not
- Get the instrument (and, optionally, a real provider's answers)
- Assess the high-signal domains
- Score residual risk into one number and a ranked gap list
- Turn findings into a follow-up list — and judge the evidence honestly
- What you just built — and its honest limit