CAIQ v4
Control DSP-01
Extractive Review Standard
How to answer 'Do you have a data classification policy?' on a CAIQ
Reviewer Guidance & Pitfalls
List the formal classification tiers (e.g., Public, Internal, Confidential, Restricted/Customer Data) and cite the handling rules for the highest tier. Reviewers want to see that customer data is classified at the strictest tier by default.
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. Our Data Classification Policy categorizes data into Public, Internal, Confidential, and Restricted. All customer data is classified as Restricted by default, requiring encryption at rest and in transit (SOC 2, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.