Home › Guides › CAIQ v4 › APP-01
CAIQ v4 Control APP-01 Extractive Review Standard

How to answer 'Is peer code review mandatory for all production code changes?' on a CAIQ

Reviewer Guidance & Pitfalls

State that GitHub/GitLab branch protection rules technically enforce at least 1 peer approval and passing CI status checks prior to merging to main/production branches.

Example Answer Passing Enterprise Audit

Compliant Response Template
Yes. Main production branches are locked via branch protection rules requiring at least one independent peer approval and all CI/CD security checks to pass before merging (SOC 2, CC8.1).

Filling out a CAIQ or SIG Lite right now?

QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.

Zero spam. 100% confidential. No credit card required.