CAIQ-Aligned Cloud Vendor Assessment Checklist

An editable 15-page checklist for cloud vendor reviews. Every question carries its evidence expectation, a response field and space for notes.

What’s inside

• Nine cloud questions: shared responsibility, architecture and regions, tenant isolation, API security, encryption and key management, data portability, cloud resilience, subprocessors, and mapping cloud controls to an assurance report
• Fifteen general questions covering governance, ownership, data, access, vulnerability management, logging, incident response, resilience, recovery, subcontractors, assurance, contracts and exit
• The evidence each question expects, such as a shared responsibility matrix, an isolation design or test, an encryption and key summary, and a subprocessor list
• Yes, Partly, No and Not Applicable responses, so a half-answered control can be recorded as one rather than forced to pass or fail
• A six-step workflow, and a worked example on a cloud analytics vendor with five risk signals

The last pages show the same review running on SAFE’s TPRM platform. See how SAFE handles TPRM.