CAIQ v4
Control CEK-04
Extractive Review Standard
How to answer 'Is data encrypted in transit?' on a CAIQ
Reviewer Guidance & Pitfalls
Name the protocol version (TLS 1.2 minimum, ideally 1.3), state whether it's enforced for both external and internal/service-mesh traffic, and flag any legacy exception. A 'yes' that only covers the customer-facing edge while internal services use plaintext is the exact contradiction reviewers are trained to probe.
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. All external traffic is TLS 1.3; internal service-to-service traffic is encrypted via mTLS within the service mesh (SOC 2, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.