How to answer 'Is data encrypted in transit?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Name the protocol version (TLS 1.2 minimum, ideally 1.3), state whether it's enforced for both external and internal/service-mesh traffic, and flag any legacy exception. A 'yes' that only covers the customer-facing edge while internal services use plaintext is the exact contradiction reviewers are trained to probe.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · CEK-04
Yes. All external traffic is TLS 1.3; internal service-to-service traffic is encrypted via mTLS within the service mesh (SOC 2, CC6.1).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default