> **Source of truth:** [`../practices/EG-Vendors-OnePager.md`](../practices/EG-Vendors-OnePager.md) | **Canonical framing:** [`../HAIAMM-v3.0-Framing.md`](../HAIAMM-v3.0-Framing.md) §8 / §12

---

# Education & Guidance (EG) - Vendors Domain
## HAIAMM Assessment Questionnaire v3.0

**Practice:** Education & Guidance (EG)
**Domain:** Vendors
**Purpose:** Assess organizational maturity in building AI-vendor literacy for the entire workforce (shadow AI reduction as the primary L1 cultural outcome) and deep practitioner skills for the intake reviewer population (Security, Procurement, Legal/Privacy, TPRM) performing AI-vendor reviews, with consistent reviewer calibration on training-data posture, DPA adequacy, model provenance, and EU AI Act deployer duties.
**Scoring Model:** Evidence + Outcome Metrics (see Scoring Methodology below)

---

## Instructions

- Answer each question honestly based on **current, implemented practices** (not plans or aspirations)
- Each question has two components: **Evidence** (what you did) and **Outcome Metrics** (how well it worked)
- **Scoring uses 4 tiers:** Fully Mature (1.0), Implemented (0.67), Partial (0.33), Not Implemented (0.0)
- **Answer progressively** - Complete all Level 1 questions before Level 2
- **Level progression** - Achieve ALL questions at lower level before advancing
- **Baseline first** - Record current metric values before setting targets

---

## Scoring Methodology

| Score | Label | Criteria |
|-------|-------|----------|
| 1.0 | Fully Mature | Evidence complete AND ≥3 outcome metrics meet targets |
| 0.67 | Implemented | Evidence complete AND 2 outcome metrics meet targets |
| 0.33 | Partial | Evidence partially complete OR <2 outcome metrics meet targets |
| 0.0 | Not Implemented | No evidence of the activity in place |

---

## Maturity Level 1

**Objective:** Deliver foundational AI-vendor literacy to ≥95% of the workforce and role-based AI-vendor-review training to 100% of intake reviewer roles, with an active shadow AI awareness campaign.

---

### Question 1: Ship workforce-level AI vendor literacy training

**Q1.1:** Do you have a current-year AI-vendor literacy course (≤20 minutes) completed by ≥95% of all employees, covering what counts as an AI vendor (including AI-embedded SaaS), the AUP five rules, how to submit intake, the amnesty path, how to recognize AI features quietly enabled inside existing tools, and a before-you-paste decision aid, with content updated quarterly as the AI vendor landscape and the sanctioned catalog change?

**Evidence Required:**
- [ ] LMS module published covering what counts as an AI vendor: consumer GenAI, AI-embedded SaaS (including inside already-approved vendors), AI coding assistants, AI APIs, AI agent platforms, with concrete examples employees recognize
- [ ] AUP five-rule summary included: approved catalog, prohibited data classes, personal-account prohibition, output-review duty, disclosure obligation
- [ ] Intake submission instructions included: one URL, one form, one SLA; fast-track path for parent vendors already approved; amnesty path with named owner
- [ ] Recognizing AI features inside existing tools module: gallery of common SaaS AI activations (Notion AI, Slack AI, Zoom AI Companion, M365 Copilot, Gemini in Workspace) with instruction on whether approval covers the new AI feature
- [ ] Before-you-paste decision aid: 10-second check for regulated, confidential, or customer-identifying data
- [ ] LMS completion report showing current-year completion rate across all-employee headcount
- [ ] Named training content owner with documented quarterly review cadence

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| % workforce with current-year AI-vendor literacy completion | ___% | ___% | ≥95% | ☐ | |
| % intake reviewers with completed role-based training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta across reviewers on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg DPA-clause diffs per sample | ___ | ___ | ≤2 per sample | ☐ | |

**Metric Collection Guidance:**
- **Workforce literacy completion:** LMS current-year completion report filtered to all-employee headcount. Formula: `completed_count / total_headcount × 100`
- **Reviewer training completion:** LMS report filtered to the intake-approval-permissions group (Security, Procurement, Legal/Privacy, TPRM). 100% is a pass/fail gate; intake-approval permissions are provisioned only after training completion.
- **Calibration drift, tier:** Quarterly exercise where reviewers independently score the same sample AI-vendor intake. Record each reviewer's risk-tier assignment; calculate mean absolute deviation. Source: calibration debrief facilitator record.
- **Calibration drift, DPA-clause diffs:** Same exercise; count DPA-clause requirement determinations that differ from the facilitated consensus per reviewer per sample; average across reviewers.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No AI-vendor literacy training in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 2: Deliver role-based training for the AI-vendor intake reviewers

**Q1.2:** Has the intake reviewer population (Security, Procurement, Legal/Privacy, TPRM) completed a hands-on role-based training module (~2 hours) covering reading an AI vendor's training-data posture, DPA and AI addendum adequacy, model provenance and subprocessor chain, EU AI Act deployer duties (Art. 26/Art. 50), the priority compliance map, and the risk-tier rubric, with completion gated on intake-approval permissions and calibration drift inside target for two consecutive quarters?

**Evidence Required:**
- [ ] Reviewer training module published covering training-data posture: default training behavior, opt-out availability, retention, fine-tuning/eval use, embeddings persistence, verification in DPA and product docs, not just vendor website
- [ ] DPA and AI addendum adequacy module: required clauses (no-train commitment, subprocessor disclosure, data residency, incident notification SLA, deletion on termination), common deficiencies, redlining methodology
- [ ] Model provenance and subprocessor chain module: who actually runs inference (vendor-hosted vs. Azure/GCP/AWS vs. open-model-on-vendor-infra), how the chain changes regulatory posture
- [ ] EU AI Act deployer duties module: Art. 26 checklist (instructions for use, human oversight assignment, monitoring, logging, affected-persons disclosure, FRIA triggers); Art. 50 transparency obligations applied to the vendor in review
- [ ] Risk-tier rubric and fast-track path module: classification criteria; when not to fast-track; how to apply the priority compliance map to a given vendor
- [ ] Calibration exercise included: 3 sample intakes scored independently; facilitated debrief on tier and DPA-clause deltas
- [ ] Completion gating enforced; calibration records from two consecutive quarters showing drift inside target (≤1 tier step, ≤2 DPA-clause diffs per sample)

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| % intake reviewers with completed role-based training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg DPA-clause diffs per sample | ___ | ___ | ≤2 per sample | ☐ | |
| Reviewer throughput, intakes closed per reviewer per week (post-training trend) | ___ | ___ | trending up | ☐ | |

**Metric Collection Guidance:**
- **Reviewer training completion:** LMS completion report filtered to intake-reviewer role group. Source: LMS + access-control system confirming permissions are gated on training.
- **Calibration drift, tier:** Independent scoring of shared sample AI-vendor intakes; mean absolute tier deviation across reviewer cohort. Source: quarterly calibration debrief facilitator records.
- **Calibration drift, DPA-clause diffs:** Count of DPA-clause requirement discrepancies per sample versus facilitated consensus; averaged across reviewers. Source: calibration debrief records.
- **Reviewer throughput:** AI-vendor intake queue analytics, intakes closed per reviewer per week before and after training rollout. Source: intake queue system.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No role-based reviewer training in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 3: Run the shadow AI awareness campaign

**Q1.3:** Is a shadow AI awareness campaign running as an always-on communications program, not a one-time rollout, with at least monthly content, a visible amnesty path linked from the AUP and intake form, measurable attribution of intake submissions and amnesty disclosures to campaign channels, and deployer-duty micro-content for every regulated or customer-facing AI vendor use case active in the inventory?

**Evidence Required:**
- [ ] Campaign launch documented: executive sponsor message naming shadow AI, amnesty window announced, sanctioned catalog published
- [ ] Monthly content cadence evidenced: at least one piece per month (new vendor approved, fast-track win, anonymized intake catch with employee permission, external incident reframed as "could we trace this here?")
- [ ] "Is this AI?" series documented: periodic call-outs of AI features quietly enabled in known SaaS; instruction on whether the existing parent approval covers it
- [ ] Amnesty path linked from the AUP document, the intake form, and the sanctioned catalog page, not buried
- [ ] Campaign channel URLs tagged for attribution; intake-queue referrer-source field populated showing campaign attribution rate
- [ ] Deployer-duty micro-content (human oversight, logging, disclosure obligations) deployed for every regulated or customer-facing AI vendor use case active in the inventory
- [ ] Feedback channel for employee AI tool nominations with visible triage; nominations acknowledged within 5 BD

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Shadow AI disclosures per quarter (amnesty path, intake queue tagged "amnesty") | ___ | ___ | rises Q1–Q2 then trends down | ☐ | |
| Intake submission volume attributable to campaign channels | ___% | ___% | ≥30% of net-new intakes | ☐ | |
| % workforce with current-year AI-vendor literacy completion | ___% | ___% | ≥95% | ☐ | |
| Campaign content cadence met | ___ | ___ | ≥1 piece/month | ☐ | |

**Metric Collection Guidance:**
- **Shadow AI disclosures:** Count of intake submissions tagged "amnesty" per quarter. Expect increase in Q1–Q2 post-launch (awareness working) and decrease thereafter (sanctioned catalog adoption reducing shadow AI). Source: intake queue analytics.
- **Campaign attribution:** Percentage of net-new AI-vendor intake submissions arriving via tagged campaign channel links or form-referrer fields. Source: intake queue referrer field; UTM tracking or equivalent.
- **Workforce literacy completion:** Same methodology as Q1.1. Shared metric.
- **Content cadence:** Count of published shadow AI content pieces per calendar month. Source: content calendar or publication log.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No campaign running)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

## Maturity Level 2

**Objective:** Move from foundational literacy to scenario-based reviewer training with depth calibrated per AI-vendor risk tier, and ship targeted training to product and engineering teams building on AI vendors.

---

### Question 4: Scenario-based reviewer training from real intakes

**Q2.1:** Is there a scenario library of ≥30 anonymized real AI-vendor intake cases powering reviewer training across the org's in-scope vendor archetypes, with paired calibration exercises showing Critical-tier drift ≤1 tier step and ≤1 DPA-clause diff per sample for two consecutive quarters, including a practitioner capstone requiring three live end-to-end intakes under a senior-reviewer shadow?

**Evidence Required:**
- [ ] Scenario library of ≥30 scenarios documented, each with as-submitted vendor description, original reviewer decisions (tier, DPA/AI-addendum requirements, disagreements), and resolved outcome
- [ ] Scenarios organized per vendor archetype (inference-API vendors, AI-embedded SaaS, AI coding assistants, AI agent platforms) and per Critical/Medium/Low tier weighting
- [ ] Paired calibration exercises in place: two reviewers score the same scenario independently; debrief facilitated on tier delta and DPA-clause requirement deltas
- [ ] Critical-tier calibration drift records for two consecutive quarters showing ≤1 tier step and ≤1 DPA-clause diff per sample
- [ ] Practitioner capstone in place: reviewers run three live intakes end-to-end with a senior-reviewer shadow
- [ ] Scenario library reviewed quarterly with retirement criteria for stale scenarios documented

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Reviewer calibration drift on Critical-tier scenarios, avg tier delta | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios, avg DPA-clause diffs | ___ | ___ | ≤1 per sample | ☐ | |
| % Critical/High-tier integrations with ≥1 team member trained on product-team track | ___% | ___% | 100% | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |

**Metric Collection Guidance:**
- **Critical-tier calibration drift:** Quarterly calibration exercise focused on Critical-tier AI vendor scenarios. Record tier assignments and DPA-clause requirements from each reviewer independently; calculate mean absolute deviation. Source: calibration debrief facilitator records.
- **Product-team track coverage:** LMS completion records for product-team AI-vendor track cross-referenced against integration registry Critical/High-tier integrations. Formula: `integrations_with_trained_member / total_Critical_High_integrations × 100`
- **Content freshness:** LMS content-management change log; count modules updated within the last 90 days.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No scenario library in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 5: Product-team and engineering-team AI-vendor training

**Q2.2:** Has a distinct training track been delivered to product and engineering teams that build on AI vendors, covering EU AI Act Art. 26 deployer duties, Art. 50 disclosure in UX, output-integrity patterns, kill-switch design, and logging obligations, paired with SA reference-pattern walkthroughs, with ≥1 trained member per Critical/High-tier AI vendor integration?

**Evidence Required:**
- [ ] Product/engineering team training track developed: EU AI Act Art. 26 deployer-duty walkthroughs (instructions for use, human oversight assignment, monitoring, logging, affected-persons disclosure, FRIA triggers), Art. 50 disclosure in UX (compliant vs. non-compliant disclosure patterns)
- [ ] Output-integrity patterns module: what output-integrity means for a vendor-supplied AI capability; how to test for regression; how to log vendor AI outputs for auditability
- [ ] Kill-switch design module: what a tested kill-switch for a vendor AI integration looks like at the engineering level; how to confirm it in DR and IR
- [ ] Logging obligations module: what logs must be retained, for how long, and what format is required to satisfy deployer-duty requirements
- [ ] Each module paired with the SA reference pattern for the relevant AI vendor archetype
- [ ] Mandatory enrollment: any team owning a Critical or High-tier AI vendor integration must have ≥1 trained team member
- [ ] LMS completion records cross-referenced with integration registry showing ≥1 trained member per Critical/High-tier integration

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| % Critical/High-tier integrations with ≥1 team member trained on product-team track | ___% | ___% | 100% | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ | |
| Shadow AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |

**Metric Collection Guidance:**
- **Product-team track coverage:** LMS module completion records filtered to product-team AI-vendor track modules joined against integration registry by owning team. Formula: `integrations_with_trained_member / total_Critical_High_integrations × 100`
- **Workforce literacy maintained:** Ongoing LMS current-year completion rate; same methodology as Q1.1.
- **Campaign behavior-target achievement:** For each behavior-driven campaign, record whether post-campaign measurement met the pre-set target. Formula: `campaigns_meeting_target / total_campaigns × 100`
- **Content freshness:** LMS content management change log; modules with last-updated date within 90 days.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No product-team AI-vendor training in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 6: Behavior-driven shadow AI campaigns

**Q2.3:** Are shadow AI campaigns running on a seasonal, behavior-driven cadence tied to observed risk windows (year-end OKR rush, hiring surges, post-industry-incident moments), with pre-measured behavior targets, post-campaign measurement, ≥70% of campaigns hitting their target, and ≥80% of training content updated in the last 90 days?

**Evidence Required:**
- [ ] At least 2 behavior-driven campaigns run in the last 12 months, each with a documented pre-measured behavior target (e.g., "reduce unsanctioned ChatGPT egress from engineering by 40% in Q3")
- [ ] Post-campaign measurement records for each campaign showing whether the behavior target was met
- [ ] Campaign scheduling aligned to observed shadow AI risk windows (OKR-planning season, hiring surges, post-external-incident moments)
- [ ] Amnesty windows running alongside campaigns; disclosure volume and source attributed to campaign channels
- [ ] Campaign redesign process: campaigns missing behavior targets by >20% are redesigned
- [ ] Content change log showing ≥80% of training modules updated in last 90 days

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Shadow AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns hit target | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios | ___ | ___ | ≤1 tier step, ≤1 DPA-clause diff | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ | |

**Metric Collection Guidance:**
- **Campaign behavior-target achievement:** Post-campaign measurement comparing pre-campaign baseline to post-campaign state (e.g., egress analytics, intake queue new-submission volume, amnesty disclosure volume). Source: endpoint DLP analytics, intake queue analytics, or equivalent.
- **Content freshness:** LMS content management change log; count modules with last-updated date in the 90-day window preceding assessment date.
- **Calibration drift:** Same methodology as Q2.1.
- **Workforce literacy:** Same methodology as Q1.1.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No behavior-driven campaigns in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

## Maturity Level 3

**Objective:** Operate continuous calibration at scale, publish the AI-vendor reviewer curriculum and rubric as an industry-shared artifact, and contribute to emerging AI-vendor reviewer certification pathways.

---

### Question 7: Publish the curriculum and reviewer rubric externally

**Q3.1:** Has the AI-vendor reviewer curriculum, anonymized scenario library, reviewer rubrics, and assessment harness been published externally (CSA AI Safety Initiative, OpenSSF AI, Shared Assessments AI-vendor track, or sector ISAC) with documented adoption, citations, forks, or direct acknowledgment, and do external community contributions loop back into internal content?

**Evidence Required:**
- [ ] AI-vendor workforce literacy module published externally under permissive license or consortium deliverable (learning objectives, assessment questions, reference-card template)
- [ ] Reviewer training curriculum published externally (module outlines, DPA adequacy review methodology, EU AI Act deployer duties checklist, risk-tier rubric)
- [ ] Anonymized scenario library published (scenario format, per-archetype examples, calibration debrief format)
- [ ] Reviewer rubric published (tier-assignment criteria, DPA-clause adequacy scoring, Art. 26/50 deployer-duty scoring, SR-gap-list completeness scoring)
- [ ] External adoption evidence: citations, forks/downloads, direct adoption acknowledgment from ≥1 other organization
- [ ] Community contributions welcomed; process documented for external contributions to flow back into internal content within 30 days

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| External adoption, citations, forks, downloads of curriculum/scenario library/rubric artifacts | 0 | ___ | tracked, trending up | ☐ | |
| % Critical-tier reviewers holding an external AI-vendor reviewer credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| Live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| Contributions to industry certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |

**Metric Collection Guidance:**
- **External adoption:** Repository fork/download counts; citation tracker (Google Scholar, CSA, Shared Assessments publication references); direct outreach acknowledgment records. Tracked quarterly.
- **External credentials:** HR credential registry cross-referenced with Critical-tier AI-vendor reviewer list. Credentials in scope: Shared Assessments AI-vendor reviewer, CSA AI Safety Ambassador, ISACA AI Audit/AI Risk, ISC2 AI-related credentials where they exist. Formula: `credentialed_Critical_tier_reviewers / total_Critical_tier_reviewers × 100`
- **Live calibration cadence:** Calendar entries confirming monthly calibration rounds; facilitator sign-off records per round.
- **Industry contributions:** Contribution log; each entry includes contribution type, working group name, submission date, acceptance or publication status.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No external publication in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 8: Continuous live calibration

**Q3.2:** Is a monthly live calibration cadence operating, each round using a current anonymized AI-vendor intake from the live queue, independent reviewer scoring of tier/DPA-requirements/Art.26-duties, drift reported to the program sponsor, with calibration results feeding the scenario library within 30 days and ≥50% of Critical-tier reviewers holding an external credential where one exists?

**Evidence Required:**
- [ ] Monthly calibration calendar entries confirmed for last 12 months (or since L3 initiation)
- [ ] Per-round calibration records: anonymized vendor intake used, reviewer cohort, independent scoring results, drift calculation, facilitator debrief notes
- [ ] Drift reported to program sponsor each month with trend over last quarter
- [ ] Process documented and evidenced for adding new scenarios to the library within 30 days of calibration rounds revealing drift
- [ ] Individual reviewer coaching records for reviewers with persistent drift on specific vendor archetype types (individual drift as development signal, not performance metric)
- [ ] Credential registry showing ≥50% of Critical-tier AI-vendor reviewers credentialed where external credentials exist

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| % Critical-tier AI-vendor reviewers holding external AI-vendor reviewer credential | 0% | ___% | ≥50% (where credential exists) | ☐ | |
| Calibration results feeding scenario library within 30 days (% of drift-revealing rounds actioned) | ___% | ___% | 100% | ☐ | |
| Contributions to industry certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |

**Metric Collection Guidance:**
- **Live calibration cadence:** Program operations calendar; facilitator sign-off records per round. Count calendar months with a completed calibration round in the last 12 months.
- **External credentials:** HR credential registry; count of Critical-tier AI-vendor reviewers with recognized credential divided by total Critical-tier reviewer count.
- **Scenario library pipeline:** Change log of scenario library; count calibration rounds where drift was identified; count of those rounds resulting in a new scenario added within 30 days.
- **Industry contributions:** Contribution log maintained by program lead.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No continuous live calibration in place)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

### Question 9: Industry-certification contribution

**Q3.3:** Does the program contribute ≥2 substantive artifacts per year to industry AI-vendor reviewer certification or curriculum working groups (Shared Assessments, CSA, ISACA, ISC2, sector-specific ISAC credentials), aligning the internal reviewer capstone with certification-grade rubrics and supporting reviewers pursuing external credentials?

**Evidence Required:**
- [ ] At least 2 substantive contributions per year to industry AI-vendor reviewer certification or curriculum working groups, documented with contribution artifact, working group name, and date
- [ ] Org's internal reviewer capstone aligned with certification-grade rubrics where external AI-vendor reviewer credentials exist
- [ ] Reviewer external-credential pursuit supported: study resources, exam fee reimbursement, time allocation policy
- [ ] Process documented for external working-group outputs to update internal curriculum within 30 days
- [ ] External contributions traceable back to internal content, what is published externally matches what reviewers use internally

**Outcome Metrics:**

| Metric | Baseline | Current | Target | Met? | Notes |
|--------|----------|---------|--------|------|-------|
| Contributions to industry AI-vendor reviewer certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |
| % Critical-tier reviewers holding external credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| External adoption of curriculum artifacts (citations, forks, downloads) | 0 | ___ | tracked, trending up | ☐ | |
| Live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |

**Metric Collection Guidance:**
- **Industry contributions:** Contribution log maintained by program lead; each entry includes contribution type, working group name, submission date, acceptance or publication status.
- **External credentials:** Same methodology as Q3.2.
- **External adoption:** Repository analytics, citation tracker, Shared Assessments / CSA acknowledgment records. Trend tracked quarterly.
- **Live calibration cadence:** Same methodology as Q3.2.

**Answer:**
- ☐ **Fully Mature** (Evidence complete + ≥3 metrics meet targets)
- ☐ **Implemented** (Evidence complete + 2 metrics meet targets)
- ☐ **Partial** (Evidence partially complete + <2 metrics meet targets)
- ☐ **Not Implemented** (No industry certification contributions)

**Evidence Location:** _______________________________________________
**Metric Validation Date:** _______________________________________________
**Notes:** _______________________________________________

---

## Summary Scorecard

| Level | Q1 | Q2 | Q3 | Avg | Level Achieved? |
|-------|----|----|-----|-----|-----------------|
| L1 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L2 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L3 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |

**Practice Maturity Statement:**

The organization's EG-Vendors practice is at **Level ___** with an average score of **___**.

- Level 1 achieved when all L1 questions score ≥0.67 (Implemented)
- Level 2 achieved when all L1 questions score 1.0 (Fully Mature) AND all L2 questions score ≥0.67
- Level 3 achieved when all L1–L2 questions score 1.0 AND all L3 questions score ≥0.67

---

**Document Version:** HAIAMM v3.0
**Practice:** Education & Guidance (EG)
**Domain:** Vendors
**Last Updated:** 2026-05-15
**Author:** Verifhai