AI Governance and vCISO Readiness Diagnostic

A leadership-oriented diagnostic for security leaders, vCISOs, advisors, consultants, and GRC teams translating AI risk into controls, policy, evidence, and buyer-facing trust posture.

60 q · 75m

Question 1 of 602%

vendor risk procurement

Select the seven artifacts in a mature AI vendor approval evidence packet.

A regulated enterprise is approving an AI vendor that will process customer data, connect to enterprise systems, use model providers, and perform workflow actions.

A. Contract and DPA review for training use, product improvement, subprocessors, fallback routes.B. Technical control evidence for admin scoping.C. A single procurement approval email with no conditions.D. Rollout plan with approved data, admin configuration, user guidance, support path.E. Residual-risk decision with approver, conditions, exceptions, monitoring plan, renewal trigger, and review.F. The vendor sales deck.G. Completed AI intake with use case, data categories, user groups, connected systems.H. Assurance evidence with scope notes, gaps, compensating controls, security testing, and AI.I. Vendor AI data-flow diagram covering prompts, files, embeddings, outputs.