Answer box
Enterprise procurement teams have added an AI section to every security questionnaire — and most vendors are failing it. The questions converge: how is the model hosted, what training opt-outs apply, how are agent identities scoped, where is data residency, what audit trail exists, how is the kill switch operated, what compliance evidence is produced. This guide is the consolidated 45-question RFP — mapped to OWASP Top 10 for Agentic Applications, NIST AI RMF, ISO 42001, EU AI Act, and CSA AI-CAIQ — with a worked example of what a good answer to each looks like. Use it on both sides of the table: procuring AI capabilities, or being procured for them.
Updated 21 August 2026: expanded from 30 to 45 questions. Every question now maps to the final OWASP Top 10 for Agentic Applications (ASI01–ASI10, December 2025), ISO/IEC 42001 Annex A, the EU AI Act as amended by the Digital Omnibus, NIST AI RMF and CIS Controls v8.1 — and the whole list is available as a scored XLSX template.
Why this list exists now
Three things happened in parallel during the first half of 2026:
- CSA shipped AI-CAIQ (the AI extension to the Consensus Assessments Initiative Questionnaire), mapped to the AICM 243-control matrix. Won the 2026 CSO Award.
- Shared Assessments updated SIG to include AI-specific modules. Enterprise procurement teams now ship SIG Lite (128 questions) or SIG Core (627 questions) with AI sections.
- Practitioner discussions on LinkedIn and Security Boulevard converged on the same complaint: vendors couldn't answer the new sections. "Your security questionnaire grew an AI section and our vendors can't answer it" became the canonical practitioner quote of Q2 2026.
Underneath the noise, the questions are converging. Whatever procurement template you use — CSA AI-CAIQ, SIG, Shared Assessments, custom internal — the underlying questions hit the same operational concerns. This list is the consolidated set.
Use it as a buyer to standardize your asks. Use it as a vendor to know what you'll be asked and what a strong answer looks like. Most importantly: use it as a CISO/CIO to evaluate where your own AI program would score under outside scrutiny.
The 45 questions, organized into eight domains
Domain 1 — Model and training data (Q1-5)
Q1. Which underlying models does your product use, by version, and how is hosting structured?
Maps to: NIST AI RMF MAP-1.5, EU AI Act Art. 25, CSA AI Controls Matrix.
Good answer: Specific model names and versions (e.g., "Claude Sonnet 4.6 for primary inference; on-prem Llama 3.3 for sensitive-data inference"). Hosting jurisdictions named. Vendor-managed vs customer-managed clear. Model-pinning policy stated.
Weak answer: "We use industry-leading models." Hosting "in the cloud."
Q2. Is customer data used to train models? Under what conditions can it be?
Maps to: NIST MEASURE-2.10, ISO 42001 A.7.4, EU AI Act Art. 10.
Good answer: Default no. Opt-in only with explicit signed addendum. Even with opt-in, training data isolated from cross-customer models. Specific data-handling addenda available.
Q3. What is the retention policy for prompts, completions, and embeddings, including during incident response?
Good answer: Specific retention durations by data class. Customer-configurable retention floors. Encrypted at rest with customer-held keys where applicable. Forensic-snapshot access controlled and logged.
Q4. What evaluation, red-teaming, and bias testing has each model passed before being placed in your product?
Maps to: NIST MEASURE-2.8, ISO 42001 A.8.4, EU AI Act Art. 15(3).
Good answer: Specific evaluation frameworks (HELM, BBQ, custom enterprise eval suites). OWASP Top 10 for Agentic Applications coverage. Bias and fairness test results available on request. Red-team cadence stated.
Q5. What is your model update / version management policy, and how do you handle a major-version change?
Good answer: Customer notification window. Rollback path. Pinning available for regulated workloads.
Domain 2 — Agent architecture and execution (Q6-12)
Q6. Does your product run autonomous agents, semi-autonomous agents, or human-in-the-loop only?
Maps to: EU AI Act Art. 14, Berkeley AILCCP, OWASP Agentic Top 10 ASI09.
Good answer: Categorized clearly. If agents are autonomous, the autonomy tier per use case is documented (cf. Phil Venables' "autonomy tiers" framework).
Q7. What tools or systems can your agents call, and how is that surface controlled?
Maps to: OWASP ASI02, ISO 42001 A.8.24.
Good answer: Allowlisted tool registry. Per-customer tool scoping. Customer-controlled tool grants. AI Bill of Materials available for review.
Q8. How is agent-to-agent (A2A) communication signed, inspected, and audited?
Maps to: OWASP ASI07, NIST MEASURE-2.
Good answer: Signed identities per agent. Message inspection at the bus. Audit trail of every A2A exchange. (Many vendors will fail here — A2A is the newest of the OWASP categories.)
Q9. What is the maximum action permissions an agent can hold without explicit human authorization?
Maps to: EU AI Act Art. 14, OWASP ASI03.
Good answer: Specific thresholds by action class. Configurable per-customer. Examples of actions requiring escalation.
Q10. How are agent memory writes attributed, signed, and revoked?
Maps to: OWASP ASI06.
Good answer: Every memory write has a provenance signature (user, agent identity, session). Customer-controlled retention. Selective memory purge available.
Q11. What MCP servers does your product use or expose, and how are they governed?
Maps to: OWASP ASI04, CSA AICM.
Good answer: Signed registry. Pinned versions. AIBOM available. Tool descriptions inspected. Tool responses inspected.
Q12. How does your agent respond to indirect prompt injection in tool responses, documents, or web content?
Maps to: OWASP ASI01, NIST MEASURE-2.
Good answer: Inline inspection of every input the agent reads. Detection signatures named. Documented behavior on injection detection (block, redirect, redact, log).
Domain 3 — Identity, access, and credentials (Q13-17)
Q13. How are agent identities provisioned, scoped, and revoked?
Maps to: NIST MAP-3, ISO 42001 A.5.10, EU AI Act Art. 9(4).
Good answer: Per-agent workload identity. Not the user's token. Capability-scoped, time-bounded. Revocation atomic across the control plane.
Q14. How is the customer's IdP integrated for SSO and SCIM?
Good answer: Okta, Entra, Ping, custom OIDC supported. SCIM v2 for user provisioning. Group-based authorization mapping.
Q15. What is your model for credential storage and rotation?
Good answer: Customer credentials encrypted with customer-controlled KMS. Rotation API available. Secrets never logged in plaintext.
Q16. How do you support break-glass / emergency-access scenarios?
Good answer: Time-bounded, audit-logged, requires multi-party approval. Documented procedure.
Q17. How are non-human identities and machine accounts modeled?
Maps to: CISO AI Risk Report, RSAC 2026 agent identity track.
Good answer: NHI is a first-class concept. Each agent has its own NHI. Lifecycle is automated. Identity-vs-secrets are managed separately.
Domain 4 — Data security, privacy, and residency (Q18-21)
Q18. What is the data residency story for prompts, completions, embeddings, and audit logs?
Maps to: GDPR Art. 32, EU AI Act Art. 10, sector-specific (HIPAA, PCI).
Good answer: Customer-selectable region. Specific data centers named. No cross-region data movement without explicit customer authorization. EU-only deployment available.
Q19. What inline DLP and PII detection runs on prompts and responses?
Maps to: OWASP ASI01 + ASI06, ISO 42001 A.8.24.
Good answer: Specific data class detection (PII, PHI, financial, source code, credentials). Detection accuracy with stated false-positive rate. Customer-configurable rules. Redact/block/warn options.
Q20. How is sensitivity-label inheritance handled across prompts, responses, and mixed-source outputs?
Maps to: ISO 42001 A.8.5, Microsoft Purview readiness model.
Good answer: Labels propagate through the agent. Mixed-source outputs receive the highest label of any source. Downstream actions respect the label.
Q21. How do you respond to a data subject access request (DSAR), erasure request, or court order?
Maps to: GDPR Art. 15-17.
Good answer: Documented process. Per-user data extractable. Per-user data deletion possible with stated retention exceptions. SLA committed.
Domain 5 — Audit, logging, and evidence (Q22-25)
Q22. What is logged for every prompt, response, tool call, and policy decision?
Maps to: NIST MEASURE-2.4, ISO 42001 A.5.10/A.8.24, EU AI Act Art. 12.
Good answer: Full provenance: user, agent identity, model version, tool version, arguments (with sensitive data redacted), response hash, policy decision rationale. Logs are immutable, signed, and exportable.
Q23. How long are logs retained and where?
Good answer: Customer-configurable retention floor and ceiling. Customer-controlled archive destination available. Immutable retention for regulated workloads.
Q24. What audit and compliance reports does your product generate, mapped to which frameworks?
Maps to: ISO 42001 audit, EU AI Act Art. 11/12, NIST AI RMF MEASURE-2.
Good answer: Specific report templates mapped to ISO 42001 A.8.24, NIST AI RMF MEASURE-2 / MANAGE-2, EU AI Act Articles 9 / 11 / 12 / 15. Customer-runnable on demand.
Q25. Show me a complete audit trail for a single user task that involved at least one agent, two tool calls, and one A2A handoff.
Good answer: Single search query produces the full chain in under 10 seconds. Provenance fields populated. Logs are reproducible across redeploys.
Domain 6 — Incident response and recovery (Q26-28)
Q26. Walk through your kill switch in a live incident.
Maps to: OWASP ASI10, EU AI Act Art. 14(4)(e).
Good answer: Single control-plane operation. Stops the agent identity, revokes outstanding tokens, drops bus subscriptions, denies egress — atomically and in seconds. In-flight tool calls are explicitly cancelled or quarantined. Sibling agents unaffected. Tested monthly with measured mean time to kill.
Q27. What is your incident reporting timeline under EU AI Act Article 73?
Maps to: EU AI Act Art. 73.
Good answer: 15 days for high-risk system serious incidents; shorter for critical-infrastructure or death/serious-injury. Documented runbook. Pre-prepared notification templates.
Q28. What detection signals fire on agent misbehavior, and how are they wired into the customer's SIEM?
Good answer: Named detection signal library (tool-call rate anomaly, tool description change, inline-inspection signature hits, agent egress anomalies, goal-drift). Native integrations with Splunk, Sentinel, Chronicle, Datadog.
Domain 7 — Compliance and certifications (Q29-30)
Q29. What certifications and attestations do you hold, and what is in scope?
Good answer: SOC 2 Type II (named auditors, current report date). ISO 27001. ISO 27017 / 27018. ISO 42001 (where current). HIPAA-aligned. PCI-aligned. EU AI Act-readiness self-attested with documentation.
Q30. Can we run a private pilot in our environment that produces evidence we can show our auditors?
Good answer: Yes, with a stated pilot scope, timeline, and what evidence the pilot will produce. Pilot evidence is portable; it doesn't expire when the pilot ends. Customer keeps the artifacts.
Domain 8 — Agentic risks, mapped to OWASP ASI01–ASI10 (Q31-45)
The original seven domains were written before OWASP finalised its Top 10 for Agentic Applications on 9 December 2025. These fifteen questions close the gap: one or two per ASI category, each with the framework clauses it evidences and the answer that should end the conversation.
Q31. How do you detect and block goal hijack through direct and indirect prompt injection in the content the agent reads — documents, web pages, emails, tool outputs — and can you show dated test results?
Maps to: OWASP ASI01; ISO 42001 A.6.2.4; EU AI Act Art. 26(2); NIST AI RMF MEASURE 2; CIS v8.1 16.14.
Evidence to request: Red-team report with dates and injection corpus; architecture of input sanitisation and trust boundaries.
Good answer: Named detection layers for prompt and tool-output injection, a test corpus, pass rates with dates, and an approval gate for high-impact actions that injection cannot bypass.
Weak answer: "Our model is resistant to prompt injection."
Q32. Are agent goals, system prompts and guardrails version-controlled, peer-reviewed and auditable, with a documented change process and rollback?
Maps to: OWASP ASI01; ISO 42001 A.6.2.3, A.6.2.7; NIST AI RMF GOVERN 1; CIS v8.1 4.1.
Evidence to request: Change log for system prompts and guardrails; approval workflow screenshots.
Good answer: Prompts and guardrails live in version control with reviewers, diffs, and rollback; every production change has an approver and a timestamp.
Weak answer: Prompts are edited in an admin UI by whoever has access; no history.
Q33. Is every tool scoped to least privilege, are arguments validated before execution, and do destructive actions — delete, send, pay, push — require explicit confirmation?
Maps to: OWASP ASI02; ISO 42001 A.4.4, A.9.4; NIST AI RMF MAP 4; CIS v8.1 6.8, 2.5.
Evidence to request: Tool allowlist with per-tool scopes; list of actions classified as destructive; confirmation flow demo.
Good answer: A per-tool permission model, schema validation of arguments, a named class of destructive actions that always gate on a human, and logs of each gate decision.
Weak answer: Tools inherit the user's full permissions; "the agent is careful."
Q34. How do you detect poisoned or drifting tool descriptors — manifest changes after approval, tool-name collisions, altered parameter descriptions — across the MCP servers and plugins the agent uses?
Maps to: OWASP ASI02, ASI04; OWASP MCP03; CIS v8.1 2.5, 13; NSA MCP guidance (20 May 2026).
Evidence to request: Manifest hashing/signing process; alert samples for descriptor drift.
Good answer: Manifests are pinned and signed; any change re-triggers review; name collisions and description changes raise alerts before the tool is callable.
Weak answer: Tools are refreshed automatically from the server on each session.
Q35. Does each agent run under a unique, bounded identity with short-lived, per-invocation credentials, and how do you prevent confused-deputy and delegation-chain abuse?
Maps to: OWASP ASI03; ISO 42001 A.3.2; NIST AI RMF GOVERN 2; CIS v8.1 5.5, 6.5; MCP spec: servers MUST NOT accept tokens not issued for them.
Evidence to request: Identity architecture diagram; token lifetimes; service-account inventory entry per agent.
Good answer: One identity per agent, credentials minted per task or invocation with minutes-long lifetimes, no shared service accounts, and token audience checks at every hop.
Weak answer: Agents use a shared integration account; tokens are long-lived "for reliability."
Q36. How are sessions, caches and memory isolated between users and tasks, and what forces re-authorisation when an agent's privileges escalate mid-task?
Maps to: OWASP ASI03; OWASP MCP10; ISO 42001 A.9.2; CIS v8.1 6.1, 6.2.
Evidence to request: Session isolation design; escalation policy; test evidence that one user's context cannot reach another's.
Good answer: Per-user, per-task isolation with cache wiping between sessions; any scope elevation requires a fresh authorisation and is logged with a correlation ID.
Weak answer: Sessions are isolated "at the application level"; escalation is handled by the model.
Q37. Can you provide a signed AI bill of materials — models, plugins, MCP servers, skills, datasets — with provenance and pinned versions, and what happens when a component is found compromised?
Maps to: OWASP ASI04; ISO 42001 A.10.3, A.7.5; EU AI Act Art. 25(4), Art. 53 / Annex XII; NIST AI RMF GOVERN 6, MAP 4, MANAGE 3; CIS v8.1 16.4, 16.5, 15.1–15.7.
Evidence to request: Current AI-BOM; signing/verification process; a past component-incident timeline.
Good answer: A machine-readable, signed inventory per release; dependencies pinned; a documented quarantine-and-rotate runbook with an example of it being used.
Weak answer: "We use reputable open-source components." No inventory available.
Q38. Where agent-generated code or commands execute, what OS-level sandboxing is used, is generation separated from execution by an approval gate, and what outbound network access does the sandbox have?
Maps to: OWASP ASI05; OWASP MCP05; CIS v8.1 4.1, 2.7, 16.7; NSA MCP guidance (seccomp / AppArmor / SELinux / AppContainer-class isolation).
Evidence to request: Sandbox architecture; egress allowlist; approval-gate demo.
Good answer: Non-root, seccomp/AppArmor-style sandboxes with no default egress; code is reviewed or gated before execution; the sandbox cannot reach production credentials.
Weak answer: Code runs in "a secure container"; egress is open so tools can fetch what they need.
Q39. How are memory and retrieval writes validated, segmented by user, task and domain, scored for provenance, and snapshotted for rollback — and can agent outputs auto-ingest into memory?
Maps to: OWASP ASI06; ISO 42001 A.7.4, A.7.5, A.7.6; CIS v8.1 3.2, 3.12, 11.1.
Evidence to request: Memory architecture; provenance scoring; rollback procedure and retention.
Good answer: Writes are validated and tagged with source and trust level; memory is segmented; agent outputs never auto-ingest; snapshots allow point-in-time rollback.
Weak answer: A single shared vector store; "the model learns from every conversation."
Q40. For agent-to-agent communication, is mutual TLS enforced, are messages signed with nonces and timestamps and schema-validated, and is agent discovery authenticated?
Maps to: OWASP ASI07; CIS v8.1 3.10, 12, 13; NSA MCP guidance (signed JSON-RPC payloads with expiry and replay protection).
Evidence to request: Protocol specification; certificate management; replay-protection test results.
Good answer: mTLS between agents, signed and schema-validated messages with replay protection, and an authenticated directory for discovery.
Weak answer: Agents talk over HTTPS "inside our VPC"; messages are trusted because they are internal.
Q41. What fault isolation, task-scoped credentials, rate limits and circuit breakers prevent a single hallucination, corrupted memory or poisoned component from cascading across agents and environments?
Maps to: OWASP ASI08; ISO 42001 A.6.2.6; EU AI Act Art. 26(5); NIST AI RMF MANAGE 4; CIS v8.1 17.4, 17.9.
Evidence to request: Blast-radius analysis; circuit-breaker configuration; incident thresholds.
Good answer: Planning separated from execution, per-task credentials, rate limits and circuit breakers per agent, and documented thresholds that halt a workflow automatically.
Weak answer: "Failures are rare"; recovery is manual.
Q42. How does the product label confidence, require explicit confirmation for high-impact recommendations, and keep immutable records of what the agent suggested and what the human did?
Maps to: OWASP ASI09; ISO 42001 A.8.2, A.9.2; EU AI Act Art. 50(1), (5), Art. 26(11); NIST AI RMF GOVERN 4; CIS v8.1 14.
Evidence to request: UI showing confidence and AI disclosure; suggestion log samples.
Good answer: Clear AI disclosure at first interaction, confidence labels, confirmation for high-impact actions, and an append-only log of suggestions and outcomes.
Weak answer: Recommendations are presented as answers; no record of what was suggested.
Q43. What behavioural monitoring detects an agent deviating from its authorised scope, and what is the kill switch — does it terminate running tasks, revoke every credential the agent holds, and how quickly?
Maps to: OWASP ASI10; ISO 42001 A.6.2.8, A.8.4; EU AI Act Art. 26(6) (logs ≥ 6 months), Art. 55; NIST AI RMF MEASURE 3; CIS v8.1 8.2, 8.5, 8.10, 17.4.
Evidence to request: Kill-switch runbook with measured time-to-stop; behavioural alert catalogue; log retention settings.
Good answer: Watchdog monitoring for out-of-scope behaviour, a stop that terminates runs and revokes credentials in one action, measured in seconds and tested quarterly, and logs retained for at least six months.
Weak answer: "We can disable the integration" — with no revocation of harvested credentials and no measured time.
Q44. How are agents decommissioned — owner assignment, inactivity detection, automatic credential revocation and removal from registries — and can you evidence it for a past agent?
Maps to: OWASP ASI10; ISO 42001 A.6.2.x life cycle; NIST AI RMF MANAGE 4; CIS v8.1 5.3, 15.7.
Evidence to request: Lifecycle policy; an example decommission record with timestamps.
Good answer: Every agent has an owner and an expiry; inactivity triggers review; decommission revokes tokens, removes registry entries and archives logs, with evidence.
Weak answer: Agents persist until someone remembers to remove them.
Q45. Have you tested the product against the OWASP Top 10 for Agentic Applications and the OWASP MCP Top 10, and will you share the red-team methodology, results and dates under NDA?
Maps to: OWASP ASI01–ASI10; OWASP MCP01–MCP10; ISO 42001 A.6.2.4; NIST AI RMF MEASURE 2; CIS v8.1 18.1, 16.13.
Evidence to request: Red-team report; remediation tracker; re-test cadence.
Good answer: Independent or internal red-team results per ASI category, dated within 12 months, with remediation status and a commitment to re-test on major releases.
Weak answer: Testing is "ongoing"; nothing can be shared.
The ASI crosswalk
Which questions evidence which OWASP agentic risk. Use it to see, per vendor, where the weak answers cluster.
| OWASP ASI | Questions | Also evidences |
|---|---|---|
| ASI01 Agent Goal Hijack | Q31, Q32, Q45 | ISO 42001 A.6.2.4 · EU AI Act Art. 26(2) · CIS 16.14 |
| ASI02 Tool Misuse & Exploitation | Q6, Q7, Q10, Q33, Q34 | ISO 42001 A.4.4, A.9.4 · CIS 6.8, 2.5 |
| ASI03 Identity & Privilege Abuse | Q13–Q17, Q35, Q36 | ISO 42001 A.3.2 · CIS 5.5, 6.5 · MCP spec token-audience rule |
| ASI04 Agentic Supply Chain Vulnerabilities | Q1, Q2, Q4, Q5, Q34, Q37 | EU AI Act Art. 25(4), Art. 53 · ISO 42001 A.10.3, A.7.5 · CIS 16.4, 16.5, 15.x |
| ASI05 Unexpected Code Execution | Q8, Q38 | CIS 4.1, 2.7, 16.7 · NSA MCP guidance on sandboxing |
| ASI06 Memory & Context Poisoning | Q3, Q18–Q21, Q39 | ISO 42001 A.7.4–A.7.6 · CIS 3.2, 3.12, 11.1 |
| ASI07 Insecure Inter-Agent Communication | Q11, Q40 | CIS 3.10, 12, 13 · NSA signed JSON-RPC guidance |
| ASI08 Cascading Failures | Q9, Q12, Q26, Q28, Q41 | ISO 42001 A.6.2.6 · EU AI Act Art. 26(5) · CIS 17.4, 17.9 |
| ASI09 Human-Agent Trust Exploitation | Q42 | EU AI Act Art. 50(1), Art. 26(11) · ISO 42001 A.8.2 · CIS 14 |
| ASI10 Rogue Agents | Q22–Q25, Q27, Q43, Q44, Q45 | EU AI Act Art. 26(6), Art. 55 · ISO 42001 A.6.2.8, A.8.4 · CIS 8.2, 8.5, 8.10, 17.4 |
Download the scored RFP template
All 45 questions, the framework mapping, the evidence to request and the red-flag answers are in a spreadsheet with 0–3 scoring, adjustable weights and a scorecard that totals by domain and by ASI category — so a vendor's weakest agentic risk is visible on one sheet. Get the XLSX template →
What a "good answer" actually looks like
Three structural traits, applied to every question:
- Specific. Names, numbers, dates, versions, jurisdictions. Not "industry-leading," "best-in-class," or "robust."
- Mapped. Every answer references the framework it supports — OWASP, NIST, ISO 42001, EU AI Act, CSA AICM, GDPR. Procurement teams' job is easier when the vendor pre-maps.
- Demonstrable. Every answer can be shown live in a demo or proven with an artifact (a SOC 2 report, an audit log export, a runbook). "Take our word for it" is not an answer.
If a vendor's answer to any of these 30 is "we'll get back to you," that's data.
How to use this list
If you're a buyer
- Use the 45 questions as your master AI RFP. Trim sections that don't apply (e.g., A2A questions for a vendor that doesn't do multi-agent).
- Score each answer 0-3 (no answer / weak / acceptable / strong). 60 points possible. Anything below 40 is a fail; above 50 is a contender.
- Run the live demo questions (Q25, Q26) in the actual demo. If they can't show, don't move forward.
- Insist on pilot evidence (Q30) before contract signature.
If you're a vendor
- Score yourself honestly against the list before any RFP arrives.
- Build the evidence artifacts (audit trail export, kill switch demo, mapping documents) before you need them. Producing under pressure is worse than producing in advance.
- Map your product capabilities to the OWASP/NIST/ISO/EU language. If you don't, the customer will, and they may map you wrong.
If you're an internal AI program owner
- Run the 30 against your own organization. Pretend you are being procured.
- Every "no" or "we'll get back to you" is a gap to close.
- Bring the scorecard to your AI risk committee. Most committees haven't seen what an outside RFP would surface.
What this looks like on AccuroAI
We score ourselves against this list publicly because we maintain it. We meet or exceed strong-answer criteria on 28 of 30. Two we're growing on: Q4 (we publish red-team results internally but not yet in a customer-portal artifact), Q24 (we have ISO 42001 + NIST AI RMF + EU AI Act report templates; the SOC 2 + HIPAA mapping templates are in development).
If you want to run this list against AccuroAI as a live exercise, book a 30-minute working session and we will go through all 30 with your procurement and security teams in the same call. The output is an evidence packet you can use whether or not you become a customer.
FAQ
What is CSA AI-CAIQ? The Cloud Security Alliance's AI extension to the Consensus Assessments Initiative Questionnaire (CAIQ). Maps to CSA's AI Controls Matrix (AICM), which has 243 controls across 18 domains. Won the 2026 CSO Award. Available free from CSA.
Is this list the same as Shared Assessments SIG? No. SIG Lite (128 questions) and SIG Core (627 questions) are broader information security questionnaires that now include AI sections. The 45-question list above consolidates the AI-specific subset across SIG, AI-CAIQ, and emerging RFP templates.
Should we use NIST AI RMF, ISO 42001, or EU AI Act as our framework? Use all three with one control library. See One Map to Rule Them All: A Unified Crosswalk Between NIST AI RMF, ISO 42001, and the EU AI Act.
Will this list become longer? Yes. The OWASP Agentic Top 10 and emerging regulator releases (UK AISI, Singapore IMDA agentic-AI framework, NIST agent identity standards) will add specifics. Treat this as a 2026 snapshot.
Is there a downloadable version? Yes — request from the contact form on accuroai.co. PDF + Excel scorecard.
Sources: CSA AI Controls Matrix · CSA AICM 2026 CSO Award · Shared Assessments SIG (AI extensions) · Kognitos — Agentic AI RFP Template · Asteros — Your Security Questionnaire Now Has an AI Section · Security Boulevard — AI Security Questionnaires · OWASP Top 10 for Agentic Applications 2026.
Related: AI-SPM Buyer's Guide 2026 · One Map to Rule Them All: Unified Compliance Crosswalk · Guardian Agents Explained.