CAIQ v4
Control IAM-09
Extractive Review Standard
How to answer 'What is your password policy?' on a CAIQ
Reviewer Guidance & Pitfalls
If you mandate SSO with MFA across all systems, emphasize that first: modern reviewers prefer 'SSO + MFA everywhere' over complex 90-day password rotation policies. If passwords are used, state minimum length (e.g. 14+ characters) and lockout thresholds.
Example Answer Passing Enterprise Audit
Compliant Response Template
All workforce authentication is enforced via centralized SSO with mandatory MFA; direct passwords for production accounts are disabled. Service credentials require minimum 24-character high-entropy secrets (SOC 2, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.