Appendix G

Vendor Questionnaire (ACR/STRIKE-aligned)

Procurement questionnaire for agentic AI platforms to ensure governance is implementable.

Vendor Information

Vendor Name

Product Name

Evaluated By

Evaluation Date

Can tool use be allowlisted/denied at runtime?

Can destinations be allowlisted with parameter constraints?

Can approvals be enforced at execution (not just UI prompts)?

Can we export traces with correlation IDs?

Are policy decisions/version at execution recorded and exportable?

Are approval artifacts exportable?

Who can enable connectors?

Can scopes be restricted (sites/mailboxes/objects)?

Are scope changes logged and reviewable?

How are model/prompt/safety changes communicated?

Can versions be pinned or delayed?

What regression evidence exists?

Retention, residency, training use, deletion support

Is data used for model training? Opt-out available?

DSAR-like support for prompts/traces/memory where applicable

SLAs for incident notification

Joint investigation support and evidence sharing

Right to run proof-of-control tests / red teaming (within policy)

Additional Notes