Vendor security questionnaire: evidence and response template

Filled preview

Illustrative worked example. Names, volumes, dates, and outcomes are fictional; replace them with approved evidence before use.

Sources: Cloud Security Alliance AI Controls Matrix and AI-CAIQ · NIST AI Risk Management Framework

Use response states

Mark each question as approved response available, needs product evidence, needs legal or privacy review, not applicable with reason, or not answered. These states prevent a sales deadline from changing the technical truth. Keep the response owner and the source check date beside the text.

If an AI feature uses file-backed retrieval, the response needs to describe the actual file, access, and retention boundary. OpenAI’s vector-store API reference, for example, describes files attached to a vector store and search behavior; it does not answer a customer’s deployment or data-processing question on its own.

Sources: OpenAI vector stores API reference · Cloud Security Alliance AI Controls Matrix and AI-CAIQ

Send a reviewable packet

Package the response with links to the product documentation, security evidence, architecture, and approved policies. Identify any scope qualification in the answer itself. A reviewer should be able to distinguish ‘documented for this hosted service’ from ‘proposed for a future customer-managed configuration.’

Sources: Cloud Security Alliance AI Controls Matrix and AI-CAIQ · NIST AI Risk Management Framework

Escalation rules

• Security or privacy owners approve policy claims.
• Engineering owners approve technical behavior and deployment boundaries.
• Commercial owners approve contractual terms.
• Sales can coordinate the packet but should not resolve an evidence gap by editing an answer.

Sources: NIST AI Risk Management Framework