# Legal Home | CAIQ-Lite Security Self-Assessment | Optimizory

Source: https://optimizory.com/caiq-lite

---

# Cloud Security Self-Assessment Questionnaire (CAIQ-Lite)

We use the Consensus Assessments Initiative Questionnaire Lite (CAIQ-Lite) from the Cloud Security Alliance as a base to clearly communicate our security posture and demonstrate the robustness of our security controls.

## Audit & Assurance

**Audit and Assurance Policy and Procedures**

**A&A-01.1**— Are audit and assurance policies, procedures, and standards established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

**A&A-01.2**— Are audit and assurance policies, procedures, and standards reviewed and updated at least annually?

Yes

**Independent Assessments**

**A&A-02.1**— Are independent audit and assurance assessments conducted according to relevant standards at least annually?

Yes

* * *

## Application Security

Application and Interface Security Policy and Procedures

**AIS-01.1**— Are application security policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained to guide appropriate planning, delivery, and support of the organization's application security capabilities?

Yes

Secure Application Design and Development

**AIS-04.1**— Is an SDLC process defined and implemented for application design, development, deployment, and operation per organizationally designed security requirements?

Yes

Automated Application Security Testing

**AIS-05.1** — Does the testing strategy outline criteria to accept new information systems, upgrades, and new versions while ensuring application security, compliance adherence, and organizational speed of delivery goals?

Yes

* * *

## Business Continuity & Disaster Recovery

Business Continuity Management Policy and Procedures

**BCR-01.1**— Are business continuity management and operational resilience policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

Business Continuity Exercises

**BCR-06.1**— Are the business continuity and operational resilience plans exercised and tested at least annually and when significant changes occur?

Yes

Disaster Response Plan

**BCR-09.1**— Is a disaster response plan established, documented, approved, applied, evaluated, and maintained to ensure recovery from natural and man-made disasters?

Yes

* * *

## Cryptography, Encryption, and Key Management

Disaster Response PlanEncryption and Key Management Policy and Procedures

**CEK-01.1**— Are cryptography, encryption, and key management policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

Data Encryption

**CEK-03.1**— Are data at-rest and in-transit cryptographically protected using cryptographic libraries certified to approved standards?

Yes

Encryption Algorithm

**CEK-04.1**— Are appropriate data protection encryption algorithms used that consider data classification, associated risks, and encryption technology usability?

Yes

CSC Key Management Capability

**CEK-08.1**— Are CSPs providing CSCs with the capacity to manage their own data encryption keys?

No

* * *

## Governance, Risk, and Compliance

Governance Program Policy and Procedures

**GRC-01.1**— Are information governance program policies and procedures sponsored by organizational leadership established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

Risk Management Program

**GRC-02.1**— Is there an established formal, documented, and leadership-sponsored enterprise risk management (ERM) program that includes policies and procedures for identification, evaluation, ownership, treatment, and acceptance of cloud security and privacy risks?

Yes

* * *

## Human Resources Security

Background Screening Policy and Procedures

**HRS-01.1**— Are background verification policies and procedures of all new employees (including but not limited to remote employees, contractors, and third parties) established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

Security Awareness Training

**HRS-11.1**— Is a security awareness training program for all employees of the organization established, documented, approved, communicated, applied, evaluated and maintained?

Yes

* * *

## Identity and Access Management

Identity and Access Management Policy and Procedures

**IAM-01.1**— Are identity and access management policies and procedures established, documented, approved, communicated, implemented, applied, evaluated, and maintained?

Yes

Least Privilege

**IAM-05.1**— Is the least privilege principle employed when implementing information system access?

Yes

Strong Authentication

**IAM-14.1**— Are processes, procedures, and technical measures for authenticating access to systems, applications, and data assets including multifactor authentication for a least-privileged user and sensitive data access defined, implemented, and evaluated?

Yes

* * *

## Logging and Monitoring

Logging and Monitoring Policy and Procedures

**LOG-01.1**— Are logging and monitoring policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

Security Monitoring and Alerting

**LOG-03.1**— Are security-related events identified and monitored within applications and the underlying infrastructure?

Yes

* * *

## Security Incident Management

Security Incident Management Policy and Procedures

**SEF-01.1**— Are policies and procedures for security incident management, e-discovery, and cloud forensics established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

Incident Response Plans

**SEF-03.1**— Is a security incident response plan that includes relevant internal departments, impacted CSCs, and other business-critical relationships (such as supply-chain) established, documented, approved, communicated, applied, evaluated, and maintained?

Yes

* * *

## Threat and Vulnerability Management

Threat and Vulnerability Management Policy and Procedures

**TVM-01.1**— Are policies and procedures established, documented, approved, communicated, applied, evaluated, and maintained to identify, report, and prioritize the remediation of vulnerabilities to protect systems against vulnerability exploitation?

Yes

Penetration Testing

**TVM-06.1**— Are processes, procedures, and technical measures defined, implemented, and evaluated for periodic, independent, third-party penetration testing?

Yes

* * *

If you have any questions or would like to discuss our security practices in more detail, please reach out to our team at [support@optimizory.com](mailto:support@optimizory.com).

## Our Products Portfolio

[](/links-explorer.html)

[](/links-explorer.html)

[

![Links-explorer Jira](/assets/img/lxp-monday-logo.webp)

#### Links Explorer for Jira

The #1 user-rated Traceability app for Jira.

](/links-explorer.html)[Read more](/links-explorer.html)

[](/rmsis.html)

[](/rmsis.html)

[

![RMsis](/assets/img/logos/rmsis/png/rmsis-3.webp)

#### RMsis

Most mature requirements management application for Jira.

](/rmsis.html)[Read more](/rmsis.html)

[](/pact.html)

[](/pact.html)

[

![PACT](./assets/img/pact-screenshots/pact-logo-1.png)

#### PACT

Your dedicated solution for efficient Contract Lifecycle Management.

](/pact.html)[Read more](/pact.html)

[](/baseline-x.html)

[](/baseline-x.html)

[

![BaselineX](/assets/img/baseline-x/baseline-x.jpg)

#### Baseline X

The ultimate tool to take issue snapshots and track changes

](/baseline-x.html)[Read more](/baseline-x.html)

[](/report-x.html)

[](/report-x.html)

[

![ReportX](/assets/img/report-x/report-x.png)

#### Report X

A Complete Traceability and Reporting Solution for Jira

](/report-x.html)[Read more](/report-x.html)

[](/customid.html)

[](/customid.html)

[

![CustomID](/assets/img/custom-id/custom-id.png)

#### Custom ID

Make your JIRA issue IDs more informative

](/customid.html)[Read more](/customid.html)

[](/rmview.html)

[](/rmview.html)

[

![RMview](/assets/img/logos/rmview/rmview.png)

#### RMview

Simplify Your Requirement Management

](/rmview.html)[Read more](/rmview.html)

[](/unifieddocs.html)

[](/unifieddocs.html)

[

![unifieddocs](/assets/img/unifieddocs/unifiedlogo.png)

#### UnifiedDocs

Dynamic Documentation for Confluence

](/unifieddocs.html)[Read more](/unifieddocs.html)

[](/risk-manager.html)

[](/risk-manager.html)

[

![unifieddocs](/assets/img/logos/risk-manager/risk-manager-logo.png)

#### Risk Manager

Risk Clarity For Everyone - Right Inside Jira

](/risk-manager.html)[Read more](/risk-manager.html)

[](https://vrest.io/)

[](https://vrest.io/)

[

![vRest](./assets/img/logos/vrest/all/png/green/logo_green.webp)

#### vREST

Record, Specify, Test and Mock your RESTful and Other Web APIs.

](https://vrest.io/)[Read more](https://vrest.io/)

[](/monday/links-explorer-product/index.html)

[](/monday/links-explorer-product/index.html)

[

![Links-explorer Monday](/assets/img/lxp-monday-logo.webp)

#### Links Explorer for monday

Get end-to-end traceability via tree view of item links.

](/monday/links-explorer-product/index.html)[Read more](/monday/links-explorer-product/index.html)

### Have any queries?

Please send a mail to [support@optimizory.com](mailto:support@optimizory.com) to get in touch with us.

[Leave a Message](https://forms.gle/mmCCppoSCDd8dtry8)

[Create Support Ticket](https://optimizory.atlassian.net/servicedesk/customer/portals)

We use cookies to improve your experience and analyze usage. For details or to change your preferences, see our [Privacy Policy](/privacy-policy.html). By clicking “Accept and Proceed” or continuing to browse, you consent to our use of cookies.

Accept and Proceed