Vendor security questionnaire: evidence and response template

Filled preview

Illustrative example. Names, volumes, dates and outcomes are fictional; replace them with approved evidence before use.

Sources: Cloud Security Alliance AI Controls Matrix and AI-CAIQ · NIST AI Risk Management Framework

Use response states

These states stop a sales deadline from changing what the product does.

If an AI feature uses file-backed retrieval, describe the actual file, access and retention boundary.

OpenAI’s vector-store API reference describes files attached to a vector store and search behavior; it doesn’t answer a customer’s deployment or data-processing question on its own.

Sources: OpenAI vector stores API reference · Cloud Security Alliance AI Controls Matrix and AI-CAIQ

Send a reviewable packet

Package the response with links to product documentation, security evidence, architecture and approved policies. State any scope qualification in the answer itself.

A reviewer should be able to tell ‘documented for this hosted service’ from ‘proposed for a future customer-managed configuration.’

Sources: Cloud Security Alliance AI Controls Matrix and AI-CAIQ · NIST AI Risk Management Framework

Escalation rules

• Security or privacy owners approve policy claims.
• Engineering owners approve technical behavior and deployment boundaries.
• Commercial owners approve contractual terms.
• Sales can coordinate the packet but should not resolve an evidence gap by editing an answer.

Sources: NIST AI Risk Management Framework