How to answer 'Is customer data encrypted at rest?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Reviewers reject a bare 'Yes'. Cite the algorithm (e.g., AES-256), the key management system, and the rotation cadence, using the exact terminology from your SOC 2 report. If a subprocessor holds the keys, say so — omitting it reads as evasion.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · CEK-03
Yes. All customer data is encrypted at rest using AES-256 via [cloud provider] managed KMS; keys rotate automatically every 365 days (SOC 2 Type II, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default