CAIQ v4
Control CEK-03
Extractive Review Standard
How to answer 'Is customer data encrypted at rest?' on a CAIQ
Reviewer Guidance & Pitfalls
Reviewers reject a bare 'Yes'. Cite the algorithm (e.g., AES-256), the key management system, and the rotation cadence, using the exact terminology from your SOC 2 report. If a subprocessor holds the keys, say so — omitting it reads as evasion.
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. All customer data is encrypted at rest using AES-256 via [cloud provider] managed KMS; keys rotate automatically every 365 days (SOC 2 Type II, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.