CAIQ
Auto-filling the CSA CAIQ from your self-assessment — and what the platform deliberately does not do.
What the generator does
The CAIQ is the Cloud Security Alliance questionnaire that enterprise customers ask cloud providers to complete. If your organization has already answered the self-assessment, much of it can be derived from what you declared rather than filled in from scratch.
You bring the file
The platform does not distribute the instrument. You upload your own CAIQ file and it writes the derived answers onto it. The decision is deliberate: the CAIQ is published by the CSA, and redistributing it is not Aranis's to do.
What gets filled and what does not
The Yes/No answer is derived from the controls mapped to that question, by the same binary rule as adherence: it is Yes when every mapped control was answered YES, with NAs out of the denominator. When no mapped control has been answered, the answer is left blank for you to fill — the platform does not guess.
The implementation description column is left empty on purpose. It asks for your words and your evidence, not the control's text — copying the control description would produce a CAIQ that describes the framework instead of describing your company.
Interpretation, and labeled as such
There is no official crosswalk between the CSA catalog and NIST CSF. The entire mapping is Aranis's interpretation, and so every generated answer is flagged as such. This is not a legal disclaimer: it is what lets you review with the right eye, knowing which answers came from a judgment call and which came from a formal equivalence — none did.