Control #
D
3
.
3
Require vendors to disclose security posture and certifications
Ask AI vendors to provide relevant security attestations (e.g. SOC 2, ISO 27001) or document their internal security and privacy practices. Review these at onboarding and periodically.
Evidence
We'll list specific evidence that demonstrates compliance with this control. Typically, this is screenshots, proof of a legal or operational policy, or product demonstrations.
Recommended actions
We'll recommend specific practices and actions for complying with this control.